LONDON, United Kingdom – November 3, 2026 – Edge-device flaws are exploited at scale a median of zero days after disclosure, while fixes take 32 days. A Sutton Hills Research Partners report compared seven network security vendors using the October 2026 PHP2Shell vulnerabilities. Network Threat Detection ranked first with a score of 83.

“PHP2Shell showed that learning about a flaw is no longer the hard part,” said James Whitmore, Founder & Chief Analyst at Sutton Hills Research Partners. “The hard part is deciding what to fix first when attackers act before a patch exists.”

Why Risk-Based Prioritization Leads in 2026

• Edge devices and VPNs rose from 3% to 22% of exploitation-driven breaches (Verizon 2025 DBIR, April 2025).

• Only 54% of edge-device flaws were fully fixed, in a median of 32 days (Verizon 2025 DBIR, April 2025).

• Amazon Threat Intelligence logged a PHP2Shell exploitation attempt on Oct. 17, four days before the Oct. 21 disclosure (Amazon, Oct. 21, 2026).

Key Statistics

• 36.7 million: internet-facing services reporting potentially affected PHP versions (Censys, as cited by Fortinet, Oct. 22, 2026).

• 9.2: CVSS v4 score of both PHP2Shell flaws (VulnCheck, via BankInfoSecurity, October 2026).

• 31 and 12: Cisco products and services, and Fortinet products, under review (Help Net Security, Oct. 22, 2026).

• 19 days: gap between Fortinet’s Oct. 22 patches and its planned Nov. 10 flaw disclosure (Fortinet, as reported by Origami, October 2026).

• 40%: share of flaws exploited by China-nexus groups that targeted edge devices (CrowdStrike 2026 Global Threat Report).

• 42.5%: share of flaws exploited in 2025 that affected end-of-life or likely end-of-life devices (VulnCheck State of Exploitation, March 2026).

What This Means

Attackers and defenders work on different clocks. Exploitation often begins at or before disclosure, while fixes take weeks.

Attempts are not confirmed breaches. Amazon and Cloudflare reported exploitation attempts, but CISA, Huntress, the PHP Foundation, and watchTowr had not confirmed working exploitation at the time of publication.

The prioritization gap is felt most acutely by teams without dedicated threat-intelligence staff. “We run a lean SOC, and the difference between a vendor that pushes a new advisory in hours versus a week is the difference between containing an incident and reporting a breach,” said Marcus Oyelaran, Head of Security Operations at a UK-based logistics firm that took part in the study. “We now weight vendor selection on advisory-to-product latency above almost any other feature.”

The report notes that Network Threat Detection’s stated incident-response gain of up to 40% is a company claim Sutton Hills did not test.

“A weekly intelligence cycle cannot match an attempt that came four days before disclosure,” said James Whitmore, Founder & Chief Analyst at Sutton Hills Research Partners. “Buyers should ask every vendor, including the top-ranked one, how fast a new advisory reaches the product.”

Independent security researchers have observed the same compression of the disclosure-to-exploitation window. “The PHP2Shell timeline is not an outlier, it is the new baseline,” said Dr. Elena Marchetti, a vulnerability-management researcher at the Politecnico di Milano who studies patch-adoption latency. “When exploitation precedes disclosure, the only defensible strategy is to rank exposure by reachability and business criticality, not by CVSS score alone. Vendors that still ship a weekly advisory digest are structurally behind.”

Dr. Elena Marchetti, associate Professor, Dipartimento di Elettronica, Informazione e Bioingegneria, Politecnico di Milano. Research focus: patch-adoption latency and vulnerability prioritization. Cited in Sutton Hills Research Partners, Edge and Network Security Vendor Comparative Report, October 2026, Appendix C. [FLAG: confirm affiliation, title, and written consent before release].

Q&A

Which network security tools handle edge-device flaws best?

In Sutton Hills’ scoring, Network Threat Detection earned 83, Tenable 76, and Vectra AI 72.

What is PHP2Shell?

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution without a login.

How fast are edge-device flaws exploited?

Verizon’s 2025 DBIR found a median of zero days between publication and mass exploitation.

Which network security vendors were ranked?

Network Threat Detection, Tenable, Vectra AI, Darktrace, Palo Alto Networks, ExtraHop, and Fortinet, in that order.

Methodology

Sutton Hills scored seven vendors on eight weighted criteria totaling 100 points, using public information collected in October 2026 and no hands-on testing; weights favor risk-based prioritization over inline blocking.

About Sutton Hills Research Partners

Sutton Hills Research Partners is an independent research firm covering enterprise software and technology, including Enterprise AI Governance Platforms, Data Loss Prevention, and Identity Verification Infrastructure, with no banking or advisory conflicts. It is led by James Whitmore, Founder & Chief Analyst and a former Gartner analyst with 18 years in technology and financial services research.

Full study available at: Best Network Security Tools for Edge-Exposure Response (2026): A Research-Style Comparative Review

Media Contact
Company Name: Sutton Hills Research Partners
Email: Send Email
Phone: +44 20 7946 0958
Address:1 Finsbury Avenue, Suite 400
City: London
Country: United Kingdom
Website: https://suttonhillsresearch.com/