The Pace of Patching Has Changed

Security Commentary Published November 10, 2026 by Adam Strohl

For decades, patching production infrastructure has involved a familiar balancing act. Security updates reduce exposure, but changes to running systems can introduce problems of their own. The traditional approach has been to assess the risk, test the update, obtain approval, schedule a maintenance window, and carefully deploy it.

That discipline exists for good reason, and it remains essential. But the time available to make those decisions has changed dramatically.

In November 2026, CrowdStrike reported that 91% of the vulnerabilities with public proof-of-concept exploits that it observed being exploited were attacked within 48 hours of the exploit's publication. The fastest observed exploitation occurred just 35 minutes after a proof of concept became public. Rapid7's third-quarter research similarly found that newly exploited high- and critical-severity vulnerabilities were being exploited an average of just three days after disclosure.

These figures represent vulnerabilities observed being exploited, not every security disclosure. Nevertheless, they illustrate a growing problem: for the vulnerabilities that matter most, defenders may have very little time to act.

Artificial intelligence is contributing to this acceleration, but the underlying challenge is broader. Attackers can rapidly turn public vulnerability research into working attacks, sometimes before vendors have even released a fix.

A change-management process that takes days or weeks may no longer be adequate when the risk of exploitation is measured in hours.

A Different Balance of Risk

The question is no longer simply whether a security update is safe to deploy. It is whether delaying that update is safer than deploying it.

That does not mean abandoning testing, approvals, or established maintenance schedules. Most updates can and should continue through normal procedures. Nor does every critical vulnerability warrant an emergency response.

What must change is the assumption that urgent security work can always wait for the next scheduled maintenance window, and that responding sooner should be treated as an improvised exception.

The appropriate response depends on the affected systems, their exposure, the credibility of the threat, available mitigations, and the operational consequences of applying an update. Sometimes immediate patching is warranted. Sometimes temporary protections are needed while a permanent fix is prepared. Often, routine maintenance remains the right answer.

Organizations must be prepared to make those distinctions quickly, with experienced people making informed decisions.

This shift is also reflected in CISA's June 2026 guidance, which emphasizes prioritizing remediation according to actual risk rather than treating every vulnerability equally.

Emergency patching should remain exceptional in its urgency, but not in its preparedness.

Preparation Makes the Difference

At A-Team Systems, our approach to infrastructure maintenance has long been built around experienced engineering judgment, established procedures, controlled execution, and ongoing monitoring.

Automation helps us carry out work consistently and efficiently, but it does not replace the engineers evaluating the risk and directing the response. We test changes in staging or representative environments where circumstances permit, coordinate with customers and their teams, and use monitoring and validation to identify operational problems following deployment.

That foundation also allows us to respond when normal maintenance timelines are no longer appropriate.

The critical PHP vulnerabilities disclosed in October 2026, widely referred to as PHP2Shell, provided a recent example. Based on the information available and the potential exposure, we initiated an expedited response across affected customer environments, notifying customers in advance and coordinating out-of-cycle security updates during business hours rather than waiting for scheduled maintenance windows.

It was an unusual decision in its urgency, but not an improvised process.

The events of 2026 have reinforced why this capability is crucial. The pace of exploitation is changing, and responsible infrastructure operations must change with it.

Speed is the result of preparation, not the abandonment of caution.

For organizations operating production infrastructure, the time to establish how urgent security decisions will be made, communicated, and executed is before the next critical vulnerability appears.

A-Team Systems continues to work with customers to ensure that security response, change management, and production reliability remain aligned as these expectations evolve.

Related Publications

A-Team Systems Monitoring Claude Mythos Preview and Project Glasswing