How security teams can assess exposure quickly and connect findings to the work that follows.

When a critical vulnerability is disclosed, security teams need to answer three questions:

Are we affected? Where are we exposed? What needs attention first?

PHP2Shell brought these questions into focus. On October 21, 2026, patches were released for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated attackers to execute arbitrary code. Amazon Threat Intelligence reported an exploitation attempt four days before public disclosure.

Teams need to identify affected assets, prioritize exposure, and determine whether attackers have already exploited the vulnerability. Those answers depend on connecting vulnerability management, threat intelligence, and SOC investigations. Gathering information across tools can take hours, and identifying exposure is only the beginning: the findings must guide remediation, threat hunting, and response.

From Exposure Findings to Security Action

Assessing exposure requires information from across the security environment, including endpoint detection, external attack surface management, vulnerability scanners, cloud inventories, and threat intelligence. Teams must bring these sources together to understand which assets are affected and what the findings mean for their environment.

But what happens after the investigation matters just as much.

An exposure finding may warrant a remediation ticket, further investigation into possible exploitation, or a threat hunt. A hunt can examine relevant web, endpoint, and other available telemetry for signs of attempted or successful exploitation. The results can then inform incident response, remediation, and further assessment. Organizational policy determines which actions can proceed automatically, which require review by a designated AI agent, and which require human approval.

These activities span different tools, procedures, and teams, but each should inform the next. Exposure findings help define where to hunt. Hunt results can change remediation priorities or trigger incident response. When those activities operate separately, analysts must rebuild context and coordinate the handoffs themselves. The opportunity is to connect them so that each investigation advances the work already underway.

A Governed, Coordinated AI Workforce

Bricklayer AI helps enterprises coordinate vulnerability investigations and the security work that follows through a governed AI workforce.

An analyst can initiate a vulnerability spot check using a CVE identifier. Specialized agents gather vulnerability intelligence and query connected security and asset systems in parallel, coordinating contributions according to their roles and expertise. Within the scope of the procedure and organizational policy, agents use the evidence they uncover to determine whether additional investigation is needed and which specialists should contribute.

Example: Coordinating vulnerability intelligence and exposure assessment.

A vulnerability-intelligence procedure gathers details for CVE-2026-109618, including severity, affected systems, attack vectors, and exploit availability. Its findings then feed into a separate, environment-specific spot check, which queries connected tools such as attack surface management, vulnerability scanning, cloud asset inventory, and XDR platforms. The results are normalized into a unified asset table, with duplicates resolved and assets categorized by severity, exploitation status, and internet reachability.

What happens next depends on what the agents find. For example, an exposed asset may warrant both remediation and a targeted hunt. If that hunt uncovers evidence of exploitation, those findings can change remediation priorities and provide the starting point for an incident investigation. This illustrates how coordinated work can develop across procedures: each contributes evidence that informs the scope, priority, and direction of subsequent work, with policy governing which actions may proceed.

Bricklayer’s approach brings together three elements:

  • Context: Combine vulnerability intelligence, asset information, and findings from across the security environment.
  • Coordination: Enable specialized agents to determine what work is needed from the available evidence, involve the right expertise, and carry findings into subsequent procedures so that each investigation informs the next.
  • Control: Keep procedures visible and govern how actions proceed, including where review and approval are required.

Together, these elements connect individual security tasks to the broader operation, while helping teams maintain visibility and control over consequential decisions.

One Five-Minute Investigation. 2,148 Affected Devices.

In one vulnerability spot check for a large, multi-entity organization, Bricklayer queried four systems: Microsoft Defender XDR, Microsoft Defender External Attack Surface Management, Qualys, and Azure Resource Graph.

Example: A vulnerability spot check across four connected security and asset systems. This investigation is separate from PHP2Shell and demonstrates how Bricklayer combines environment-specific findings.

The investigation focused on a critical vulnerability affecting SQL Server Management Studio 22 and identified 2,148 devices running vulnerable software. The findings indicated exposure, not confirmed compromise. The procedure took approximately five minutes and produced a consolidated report from the connected sources.

By bringing data from four systems together, Bricklayer helped establish the scope of exposure quickly, giving analysts a clearer basis for prioritizing remediation and deciding what to investigate next. The same approach can be applied to other vulnerabilities using the relevant CVE and the security and asset data available in the environment.

From Exposure Assessment to Coordinated Action

PHP2Shell illustrates the importance of establishing exposure quickly and connecting findings to the work that follows.

Bricklayer’s approach connects vulnerability management, threat intelligence, threat hunting, and incident response as parts of one coordinated security operation. Exposure findings guide investigations, and investigation results inform remediation and response. A governed AI workforce carries the relevant context across that work, helping teams move from understanding a vulnerability to deciding and controlling what happens next.

See how Bricklayer connects security work across your environment.