San-Fransisko, Kaliforniya, 2026-yil 3-noyabr, CyberNewswire
Amaliy sun'iy intellektga asoslangan kiberxavfsizlik kompaniyasi Cogent Security ma'lum qilishicha, PHP2Shell zaifligi korporativ zaifliklarga javob berish tizimidagi jiddiy kamchiliklarni ochib berdi.
21-oktabrda e'lon qilingan PHP2Shell PHP tizimida o'n yildan ortiq vaqt davomida saqlanib qolgan ikkita muhim zaiflikni o'z ichiga oladi.
Sun'iy intellekt yordamida olib borilgan tadqiqot zaifliklarni aniqlash va ishlaydigan eksploitlarni taxminan bir hafta ichida ishlab chiqishga yordam berdi, hujumlar esa tuzatish (patch) mavjud bo'lishidan oldin boshlangan. Cloudflare o'sha kuni millionlab eksploitatsiya urinishlarini qayd etdi.
Cogent Security tadqiqotiga ko'ra, Tinch okeani vaqti bilan soat 17:00 ga kelib, o'rtacha Fortune 500 kompaniyasi o'zining 2266 ta ta'sirlangan aktivlaridan 1% dan kamrog'ini tuzatgan edi.
Hujumchilarning tezligi va yirik kompaniyalarning javob tezligi o'rtasidagi bu farq — Cogent aynan shu muammoni yopish uchun yaratilgan.
Kiberxavfsizlikka yo'naltirilgan amaliy sun'iy intellekt laboratoriyasi bo'lgan kompaniya ketma-ket ikkinchi yil Fortune Cyber 60 ro'yxatiga kiritildi.
Fortune tomonidan Lightspeed Venture Partners va AWS bilan birgalikda ishlab chiqilgan ro'yxat hali ommaviy savdoga chiqmagan, sotib olinmagan yoki boshqa muhim chiqish (exit) bosqichiga yetmagan 60 ta eng muhim venchur kapitali bilan qo'llab-quvvatlanadigan kiberxavfsizlik startaplarini tan oladi va ularni bosqich bo'yicha guruhlaydi.
Tanlov moliyaviy natijalar, o'sish, biznes operatsiyalari va kiberxavfsizlik bozori tadqiqotlarini hisobga oladi, yakuniy ro'yxatni esa Fortune tasdiqlaydi.
"Hujumchilar allaqachon zavod kabi ishlamoqda. Sun'iy intellekt xatolarni topmoqda va eksploitlarni yozmoqda, ba'zi hollarda esa hujumning katta qismini o'zi boshqarmoqda", — dedi Cogent asoschisi va bosh direktori Vineet Edupuganti.
"Ko'pchilik korxonalar hali ham qo'lda himoyalanmoqda — bitta chipta va bitta topshirish bilan. Ikki yil ketma-ket bu ro'yxatga kirishimiz xavfsizlik rahbarlarining bu ishni bajarish usulini o'zgartirishga tayyor ekanligini ko'rsatadi."
Hujumchilar o'z zavodlarini birinchi bo'lib qurdilar
Edupuganti ishlab chiqarishdan olingan analogiyadan foydalanadi. Zavodlar yakka malakali ishchini ishlab chiqarish liniyasi bilan almashtirdi, eng ilg'or zavodlar esa asosan o'z-o'zidan ishlaydi, odamlar esa liniyani loyihalashtiradi va istisnolarni hal qiladi.
Uning fikricha, hujum (offense) allaqachon shu o'zgarishni amalga oshirgan.
Ma'lumotlar ham shuni ko'rsatadi. Google'ning M-Trends 2026 hisobotiga ko'ra, eksploitatsiya qilishning o'rtacha vaqti manfiy yetti kunni tashkil etadi, ya'ni eksploitatsiya endi tuzatish mavjud bo'lishidan oldin muntazam boshlanadi.
Tadqiqotchilar yangi e'lon qilingan zaifliklar uchun ishlaydigan eksploitlarni taxminan 15 daqiqada, har biri taxminan bir dollar narxda ishlab chiqarishni ko'rsatdilar. Anthropic to'xtatgan davlat homiyligidagi kampaniyada sun'iy intellekt agentlari taktik ishning 80-90 foizini bajargan.
Korporativ himoya hali ham eng sekin topshirish tezligida harakatlanadi. PHP2Shell paydo bo'lganda, xavfsizlik jamoalari PHP ishlaydigan har bir aktivni, jumladan asosiy tasvirlar va unutilgan serverlarni topishi, so'ngra qaysilari internetga ochiq va qaysilari biznesga bog'liq ekanligini aniqlashi kerak edi.
Shundan so'ng egalari, chiptalar, o'zgartirish oynalari va har bir tuzatishning saqlanishini tasdiqlash uchun qayta skanerlash keldi — har bir qadam malakali shaxs va vosita bilan bajarildi.
Himoyachining ishlab chiqarish liniyasini qurish
Cogentning javobi — Kiber Himoya Zavodi (Cyber Defense Factory) deb ataladigan operatsion model, bunda sun'iy intellekt agentlari hozirda xavfsizlik vositalari o'rtasida qo'lda harakatlanadigan ishni o'z zimmasiga oladi, odamlar esa agentlar amal qiladigan siyosatni belgilaydi.
Kompaniya avtonom kiber himoya uchun korporativ platforma sotadi va uning birinchi mahsuloti bu modelni zaifliklarni boshqarishga qo'llaydi.
Liniya inventarizatsiyadan boshlanadi. Agentlar bulut, mahalliy va oxirgi nuqta (endpoint) muhitlarida har bir aktivning yagona deduplikatsiyalangan yozuvini yaratadi, har birining egasi va biznes ahamiyatini kompaniya allaqachon saqlaydigan tizimlardan xulosa qiladi.
Topilmalar mijozlar allaqachon ishlatadigan skanerlar va xavfsizlik vositalaridan keladi va Cogent yangi e'lon qilingan zaifliklarni o'zining jonli dasturiy ta'minot inventarizatsiyasi bilan moslashtiradi, shunda ta'sir skanerlar yetib kelishidan oldin yuzaga chiqadi.
So'ngra agentlar zaif dasturiy ta'minot ishlayaptimi va yetib boriladimi yoki yo'qligini tekshiradi va har bir ustuvorlik ortidagi sababni yozib qo'yadi.
Cogent tuzatish ishlarini tuzatish bo'yicha guruhlaydi, shunda bitta patch o'nlab serverlarda zaiflikni hal qilishi mumkin. Har bir mijoz belgilagan avtonomiya zonalari ichida agentlar qo'llab-quvvatlanadigan tuzatishlarni o'zlari bajaradi.
Masalan, boshqariladigan oxirgi nuqtalarda ular tuzatish skriptini yozadi, uni kompaniyaning mavjud oxirgi nuqta boshqaruv platformasi orqali yuboradi va natijalarni o'qib oladi.
Ushbu zonalardan tashqaridagi o'zgarishlar bitta egaga chipta sifatida yuboriladi va shaxsning tasdiqlashini kutadi, Cogent esa ishni faqat keyingi skanerlash tuzatish saqlanganini tasdiqlaganidan so'ng yopadi.
Kompaniya maqsadi — korxonalar o'z kiberxavfsizlik funksiyalarini zavod modeli bilan o'zgartirib, 100 marta ko'proq ishni 100 marta tezroq bajarishidir.
Ko'pchilik mijozlar agentlarni yordamchi rolida boshlaydi va natijalar ishonch qozongan sari ularning vakolatini kengaytiradi — Cogent buni progressiv avtonomiya deb ataydi.
PHP2Shell modelga jonli sinov berdi. Cogentning Zero Day Response maslahatchisi va mijoz muhitlarida zaif aktivlarni o'rtacha besh daqiqada xaritaladi, skaner imzolari mavjud bo'lishidan kunlar oldin.
Cogent tadqiqotidagi o'rtacha Fortune 500 muhitiga qo'llanilganda, tahlil 2266 ta ta'sirlangan aktivni 16 tagacha qisqartirdi — ular PHP ishga tushirilgan, internetga ochiq va muhim biznes funksiyalarini qo'llab-quvvatlaydigan aktivlar edi.
Bu qisqa ro'yxat xavfsizlik jamoalari ishni boshlash uchun o'tirganda tayyor edi.
O'z modellari bilan laboratoriya
Cogent o'zini himoyaviy kiberxavfsizlikka yo'naltirilgan amaliy sun'iy intellekt laboratoriyasi deb ta'riflaydi va bu nom kompaniya qanday qurilganini aks ettiradi.
Bu xavfsizlik maqsadlari uchun o'zining ilg'or fikrlash modellarini o'rgatadigan va joylashtiradigan yagona kiberxavfsizlik kompaniyasi.
Uning soha-maxsus modeli VR-1 kiberxavfsizlik mezonlarida yuqori natijalarni ko'rsatdi va umumiy maqsadli ilg'or modellardan xavfsizlik vazifalarida ustun keldi.
Model Cogentning Kontekst Dvigateli (Context Engine) bilan birga ishlaydi, u har bir zaiflikni atrofidagi aktivlar, identifikatorlar, ilovalar, egalari va bog'liqliklar bilan bog'laydi.
Bu kontekst odatda aktiv ma'lumotlar bazalari, chipta tarixi va arxitektura hujjatlari bo'ylab tarqalgan bo'ladi va uni birlashtirish agentlarga qaysi o'zgarishlar xavfsiz ekanligini baholash imkonini beradi.
"Umumiy maqsadli sun'iy intellekt modeli hamma narsa haqida ozgina biladi", — dedi Edupuganti. "Sun'iy intellekt agenti bir necha ming ishlab chiqarish serveriga patchni yuborish xavfsizmi yoki yo'qligini hal qilayotganda, zaifliklar, eksploitlar va korporativ tizimlar qanday ishlashini o'rgangan model, shuningdek, himoya qilinayotgan kompaniya haqida chuqur kontekst kerak. Ularni birlashtirsangiz, agentlarga haqiqiy mas'uliyat berishingiz mumkin."
Eksploit soati bilan poyga
Xavfsizlik rahbarlari uchun, Edupuganti fikricha, endi muhim raqam — zaiflik e'lon qilinganidan tasdiqlangan tuzatishgacha bo'lgan vaqt, va bu oyna hujumchiga eksploitni qurish va ishga tushirish uchun kerak bo'lgan vaqtdan qisqaroq bo'lishi kerak.
Cogent bu oyna yopilishi boshqa operatsion modelni talab qiladi, deb ishonch bilan aytadi — bu yerda xavfsizlik ishi xodimlar soni bilan emas, balki ishlab chiqarish liniyasi bilan o'sadi.
Kompaniyaning Cyber 60 ro'yxatida ketma-ket ikkinchi marta paydo bo'lishi xaridorlar bu garovga isinishini ko'rsatadi, garchi Edupuganti odamlar bu jarayonning markazida qolishini kutadi.
"Eng ilg'or zavodlarda ham odamlar bor. Ular liniya nima qurishini va qanday standartni saqlashini hal qiladi", — dedi u. "Xavfsizlik jamoalari shu rolga o'tmoqda. Ular siyosatni belgilaydi va hukm chiqaradi, agentlar esa ishni mashina tezligida bajaradi."
Cogent haqida
Cogent Security — avtonom kiber himoya uchun korporativ platforma quradigan amaliy sun'iy intellekt laboratoriyasi. Uning sun'iy intellekt agentlari zaifliklarni mashina tezligida topadi va tuzatadi, shunda har bir korxona o'zining Kiber Himoya Zavodini ishlata oladi.
Avtonom zaifliklarni boshqarishdan boshlab, Cogent zaifliklarni e'lon qilinganidan tasdiqlangan tuzatishgacha bulut, mahalliy va oxirgi nuqta muhitlarida olib boradi, ta'sirni daqiqalar ichida aniqlaydi va yo'l davomida hujumchilar yetib borishi mumkin bo'lgan narsalarni tasdiqlaydi.
Mijozlar agentlar amal qiladigan siyosatni belgilaydi va qaysi tuzatishlar avtonom ravishda ishlashini, qaysilari tasdiqlashni kutishini hal qiladi.
Cogentdan foydalanadigan Fortune 500 xavfsizlik jamoalari muhim zaifliklar uchun ta'sir oynasini 97 foizga qisqartirdilar.
Google DeepMind, Abnormal Security va Coinbase'dan tadqiqotchilar va operatorlar tomonidan qurilgan Cogent Greylock Partners va Bain Capital Ventures tomonidan qo'llab-quvvatlanadi. Batafsil ma'lumot cogent.com saytida.
Ignacio Ramirez
press@cogent.com
San Francisco, CA, November 3rd, 2026, CyberNewswire
Cogent Security, an applied AI cybersecurity company, reported that the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response.
Disclosed on October 21, PHP2Shell involved two critical flaws that had remained in PHP for more than a decade.
AI-assisted research helped identify the vulnerabilities and develop working exploits in approximately one week, with attacks beginning before a patch was available. Cloudflare recorded millions of exploitation attempts that day.
According to Cogent Security’s research, by 5 p.m. Pacific, the average Fortune 500 company had patched fewer than 1% of its 2,266 affected assets.
That gap between how fast attackers move and how fast large companies respond is the problem Cogent was built to close.
The company, an applied AI lab focused on cybersecurity, has been named to the Fortune Cyber 60 for the second consecutive year.
The list, developed by Fortune with Lightspeed Venture Partners and AWS, recognizes 60 of the most important venture-backed cybersecurity startups that have yet to go public, be acquired, or reach another significant exit, grouped by stage.
Selection weighs financial performance, growth, business operations, and cybersecurity market research, and Fortune validates the final list.
“Attackers already run like a factory. AI is finding the bugs and writing the exploits, and in some cases it’s running most of the attack,” said Vineet Edupuganti, Cogent’s co-founder and CEO.
“Most enterprises are still defending by hand, one ticket and one handoff at a time. Making this list two years in a row tells us security leaders are ready to change how that work gets done.”
The attackers built their factories first
Edupuganti borrows an analogy from manufacturing. Factories replaced the lone skilled worker with a production line, and the most advanced plants now run largely on their own while people design the line and handle the exceptions.
Offense, he argues, has already made that shift.
The data points the same way. Google’s M-Trends 2026 report estimates the mean time to exploit at negative seven days, which means exploitation now routinely begins before a fix exists.
Researchers have shown AI producing working exploits for newly published vulnerabilities in about 15 minutes, at roughly a dollar apiece. In a state-sponsored campaign that Anthropic disrupted, AI agents carried out 80 to 90% of the tactical work.
Enterprise defense still moves at the pace of its slowest handoff. When PHP2Shell landed, security teams had to find every asset running PHP, including base images and forgotten servers, then work out which were internet-facing and which the business depended on.
After that came owners, tickets, change windows, and a rescan to confirm each fix held, with every step falling to a skilled person with a tool.
Building the Defender’s Production Line
Cogent’s answer is what it calls the Cyber Defense Factory, an operating model in which AI agents take over the work that now moves by hand between security tools, while people set the policies those agents follow.
The company sells an enterprise platform for autonomous cyber defense, and its first product applies the model to vulnerability management.
The line starts with an inventory. Agents build one deduplicated record of every asset across cloud, on-premises and endpoint environments, inferring each one’s owner and business importance from systems the company already keeps.
Findings flow in from the scanners and security tools customers already run, and Cogent matches newly published vulnerabilities against its live software inventory so exposure surfaces before scanners catch up.
Agents then check whether the vulnerable software is running and reachable, and they write out the reasoning behind every priority.
Cogent groups remediation work by fix, so one patch can resolve a vulnerability across dozens of servers. Inside the autonomy zones each customer defines, agents carry out supported fixes on their own.
On managed endpoints, for instance, they write the remediation script, push it through the company’s existing endpoint management platform, and read back the results.
Changes outside those zones go to a single owner as a ticket and wait for a person’s approval, and Cogent closes the work only after the next scan confirms the fix held.
The company says the goal is for enterprises to transform their cybersecurity functions with a factory model to do 100 times more work, 100 times faster.
Most customers start with agents in an assistive role and widen their authority as the results earn trust, an approach Cogent calls progressive autonomy.
PHP2Shell gave the model a live test. Cogent’s Zero Day Response processed the advisory and mapped vulnerable assets across customer environments in an average of five minutes, days before scanner signatures were available.
Applied to the average Fortune 500 environment in Cogent’s research, the analysis cut 2,266 affected assets down to 16 that had PHP loaded at runtime, faced the internet, and supported critical business functions.
That shortlist was waiting for security teams when they sat down to start work.
A Lab With Its Own Models
Cogent describes itself as an applied AI lab that just happens to focus on defensive cybersecurity, and the label reflects how the company is built.
It is the only cybersecurity company that trains and deploys its own frontier reasoning models for security use cases.
Its domain-specific model, VR-1, has topped cybersecurity benchmarks, outperforming general-purpose frontier models on security tasks.
The model works alongside Cogent’s Context Engine, which ties each vulnerability to the assets, identities, applications, owners, and dependencies around it.
That context usually sits scattered across asset databases, ticket histories and architecture documents, and pulling it together is what lets agents judge which changes are safe to make.
“A general-purpose AI model knows a little about everything,” Edupuganti said. “When an AI agent is deciding whether a patch is safe to push to a few thousand production servers, it needs a model that has learned how vulnerabilities, exploits and enterprise systems behave, plus deep context on the company it’s protecting. Put those together and you can give agents real responsibility.”
Racing the Exploit Clock
For security leaders, Edupuganti argues, the number that matters now is the time between a vulnerability’s disclosure and a verified fix, and that window has to be shorter than the time an attacker needs to build and launch an exploit.
Cogent is betting that closing it takes a different operating model, one where security work grows with the production line rather than with headcount.
The company’s second straight appearance on the Cyber 60 suggests buyers are warming to that bet, though Edupuganti expects people to stay at the center of it.
“The most advanced factories still have people in them. They decide what the line builds and the standard it holds,” he said. “Security teams are moving into that role. They set the policy and make the judgment calls, and the agents do the work at machine speed.”
About Cogent
Cogent Security is an applied AI lab building the enterprise platform for autonomous cyber defense. Its AI agents find and fix vulnerabilities at machine speed so every enterprise can run its own Cyber Defense Factory.
Starting with autonomous vulnerability management, Cogent carries vulnerabilities from disclosure to a verified fix across cloud, on-premises, and endpoint environments, identifying exposure within minutes and confirming what attackers can reach along the way.
Customers set the policies the agents follow and decide which fixes run autonomously and which wait for approval.
Fortune 500 security teams using Cogent have reduced the exposure window for critical vulnerabilities by 97 percent.
Built by researchers and operators from Google DeepMind, Abnormal Security, and Coinbase, Cogent is backed by Greylock Partners and Bain Capital Ventures. Learn more at cogent.com.
Ignacio Ramirez
press@cogent.com
