When critical vulnerabilities emerge, protecting applications requires more than a fast response. It demands early intelligence, precision, continuous adaptation, and customer trust.
On October 21, 2026, two critical PHP remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — were publicly disclosed, creating an urgent need for organizations to protect their applications.
At Akamai, our response began before the disclosure and reflects a broader evolution in how we approach vulnerability intelligence and protection.
Our threat research team worked directly with the vulnerability reporter ahead of public disclosure to analyze exploit details and develop targeted protections while honoring the industry's coordinated disclosure embargo.
By 10:00 AM ET, when the vulnerabilities became public, Akamai had deployed Rapid Rule 3000991 across 100% of its network in Alert mode. Existing command injection protections also provided an additional layer of defense against identified attack payloads.
But deploying detection is only half the challenge. At global scale, accuracy matters just as much as speed.
Our teams continuously evaluated rule triggers, identified false positives, and refined detection logic before transitioning to active enforcement.
10:00 AM ET: Detection active globally
12:40 PM ET: Updated detection logic deployed to improve accuracy
1:36 PM ET: Akamai-managed action switched to deny, enabling active blocking
5:45 PM ET: Additional accuracy refinements completed
In less than four hours, we moved from globally deployed detection to active enforcement, balancing rapid protection with application availability.
Moving from initial detection to blocking across a global edge requires an architecture engineered for both velocity and zero platform disruption, including:
Closed-loop safety and monitoring
Near–real-time trigger telemetry
Switching managed actions in minutes
When deploying rapid emergency protections, Akamai’s release engineering, QA, and web application firewall (WAF) threat research teams operate in continuous lockstep, running automated and human-in-the-loop checks across the massive global network to ensure platform stability never comes at the expense of speed.
This is powered by a three-phase deployment of these updated protections with gradually increasing network coverage and a baked-in monitoring period to observe continued platform stability and performance.
As Rapid Rule 3000991 deployed across our distributed network, our telemetry pipelines provided near–real-time visibility into global traffic triggers and rule matches. This feedback loop allowed our threat research teams to immediately observe payload interactions with live traffic patterns across all unique application and API implementations, identify edge cases, and deploy refined detection logic.
By employing our recently released rapid action change capability, our teams were able to flip the global default action to mitigate exploitation attempts within minutes once the moment confidence thresholds are met. All while customers continue to have the ability to define their own granular customizations per their business and application needs.
One of the challenges facing security teams is that vulnerability intelligence is constantly evolving. New proof-of-concept (PoC) exploits can emerge days or weeks after a CVE is initially assessed.
A vulnerability with no known exploit today may have one tomorrow.
At Akamai, we gather advanced vulnerability intelligence by deploying agentic AI to automate end-to-end CVE triage and continuously hunt threats.
Our AI agents are always operating, ingesting and triaging CVE inquiries, gathering intelligence from disjointed sources, hunting down emerging attack variants, and automatically validating them against our existing protection rules (Figure).
Crucially, our security researchers remain in full control. By uniting autonomous AI execution with expert human oversight, we remove manual investigative drag and allow our research team to scale massively. Our experts focus their deep domain expertise on what matters most, enabling us to deliver faster, higher-quality, continuous protection to our customers before threats evolve.
During a critical security event, customers need more than technical mitigations. They need transparency, timely guidance, and the confidence that their security partner is actively managing the situation.
Throughout the PHP vulnerability response, our teams proactively communicated updates and mitigation guidance.
A large financial services company specifically recognized the team's proactive communication and smooth execution, noting that they did not need to repeatedly request updates because we were already regularly sharing information with them.
Another security leader at a major global enterprise shared that they were championing the phrase “Thank goodness Akamai WAF is protecting us” across their leadership teams. Beyond the rapid mitigation, the security leader specifically appreciated our intuitive rule naming, noting that clearly citing the target CVEs directly in the rule description gave them immediate clarity by eliminating the confusion often caused by cryptic identifiers.
The PHP vulnerability response demonstrates what is possible when early threat intelligence, globally distributed protections, rapid enforcement, and proactive customer engagement work together.
Our continued investment in AI-assisted vulnerability intelligence takes this approach further by helping researchers discover emerging exploit evidence, accelerate assessments, and continuously revisit potential risks.
WAF protections are an important layer of defense while organizations apply vendor patches, which remain essential.
For customers, our direction is clear: faster access to protections, greater precision, reduced operational burden, and security intelligence that doesn't stop at disclosure.
Because effective security isn't just about responding to yesterday's threats. It's about continuously preparing for what comes next.
For additional technical details, read our security research advisory.
© 2026 Akamai Technologies
