On 21 October 2026, the PHP project released security updates addressing two vulnerabilities in the PHP engine, publicly referred to as PHP2Shell. Both vulnerabilities permit an unauthenticated remote party to execute code on a web server running PHP. One of them also permits the disclosure of process memory, which may contain credentials, session tokens, API keys and certificates.

In February 2026, Gartner named a new category: Preemptive Exposure Management. It is defined as technology that systematically disrupts and denies adversary behaviour, automating attack-path identification and simulating adversary behaviour to close exposures before they are weaponised. By 2029, Gartner expects 60 percent of organisations to have adopted structured exposure validation, but only 30 percent to have connected those results to automated remediation. The validation gate gets built well before the interdiction gate—and that is the gap this paper addresses.