A software patching backlog is a live risk to customer-facing services, customer data and trust, not a maintenance problem that can wait for the next release cycle.
Recent AI-driven cybersecurity vulnerability discoveries and exploits demonstrate just how quickly the window between a critical vulnerability being found and being exploited is shrinking, as AI is giving researchers and attackers faster ways to inspect code, test attack paths and turn flaws into workable exploits.
Anthropic’s release of Claude Mythos 5.2 and Fable 5.2, with stronger coding and reasoning capabilities, underlines how quickly those capabilities are advancing.
The disclosure last month of security vulnerabilities in the PHP web programming language emphasized the risk to enterprise software deployments and why customer experience leaders need to adapt to the new security reality.
Fabien Potencier, creator of the Symfony PHP web application framework and currently Chief Product and Technology Officer at cloud application platform Upsun, warned in an interview with CX Today that enterprises can no longer leave stable but ageing applications untouched.
“Those old applications, they don’t have that many tests, which means that they are not updated also because it’s kind of scary to update them, you’re like, ‘it is stable, it works, so we are not going to touch them,’ which quite frankly is not something that is possible anymore.”
CX leaders do not need to own patch deployment. But they do need to know which systems support key customer journeys, whether those systems can be updated quickly and what happens to customers if a service needs to be restricted or taken offline.
PHP Vulnerabilities Highlight the Customer Experience Risk
The PHP incident gives CX leaders a clear checklist.
PHP sits behind many enterprise websites, account areas, commerce platforms, customer service portals, CMS deployments and third-party services. The flaws can allow an attacker to execute code without authentication. In some cases, the attack can run before an application’s own security controls are reached.
The issue has moved beyond a theoretical risk. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. Palo Alto Networks said: “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.”
Test and Deploy Security Patches Without Breaking CX
First, they need visibility. Teams should identify every platform behind priority customer journeys, which includes websites, account portals and support platforms, but also legacy applications, CMS tools, integrations and supplier-hosted software.
“Just being able to have a good understanding of all the applications that need updates is the very first step,” Potencier said.
The exercise should focus on customer impact. Teams need to know which systems contain customer data, which journeys would fail if a platform lost internet access, and where customers could turn if a digital channel went down.
If an account portal becomes unavailable, call volumes may rise. If a payment page or booking flow goes offline, the business can lose revenue quickly. If a support platform is compromised, customers lose a service channel at the point they may need help most.
Second, enterprises need to make change safer. Security teams can identify a patch, but they must be able to deploy it without unnecessarily breaking customer journeys. Potencier said: