I think it's the wrong question to ask in 2026. By the time a CVE is published and then a new version of software released it's too late--the vulnerability is very likely to have been used in the wild for some period of time already, quite possibly by multiple actors who have independently discovered the vulnerability. Patching is essentially now an ineffective control for mitigating security risks--other controls have to be used instead.
Examples of the type of alternate questions to ask in 2026 may include:
- Does my software/system have a robust architecture where a failure of one component (e.g. RCE in a PHP process) has a minor impact, rather than a catastrophic impact? For example, a minor impact might be just the opportunity for an attacker to chain a PHP RCE with kernel LPE for some common syscall, rather than mass loss of every user's data to the attacker. I raised some PHP web application specific ideas in another thread at [1] but the answer to this question is product-agnostic and should consider microservices architecture vs. monolithic web application with access to everything, and use case/requirements development that considers matters such as users wanting to isolate their own access. For example, allowing bank users read only login for bank accounts vs. separate login for making transfers. Or implementing business process changes such as delayed commit for sensitive user actions--e.g. force delay a bank transfer by 24h and notify the user via various means giving them a chance to undo the transfer before they no longer can.
- How can I keep up-to-date with the latest software/system security architecture trends? What is the equivalent of [2] for learning about architecture patterns to potentially use for a simple eCommerce site, HR/finance web application, etc in 2026? For components of a web application such as interpreter, database server, etc--what options exist for each and how good is the project's choice of software languages, dependencies, etc to offer the strongest security protections in 2026? When was the last time I checked if someone had written an interpreter for PHP, Python, etc in Rust, SPARK, or whatever, or written an interpreter with much more comprehensive unit testing included?
- How quickly can my users or I detect security incidents / deviations of system behaviour from typical state? For example, [3] was discussed on HN today as once such detection mechanism where canary tokens are deliberately littered throughout a system or dataset. The security incident may have already happened, but early detection forces an attacker to burn their vulnerability chain quickly on their most highly prized target and not be able to use it against a mass of targets over a long duration of time.
[1] https://news.ycombinator.com/item?id=50184239
[2] https://aosabook.org/en/index.html
[3] https://news.ycombinator.com/item?id=50185630
Examples of the type of alternate questions to ask in 2026 may include:
- Does my software/system have a robust architecture where a failure of one component (e.g. RCE in a PHP process) has a minor impact, rather than a catastrophic impact? For example, a minor impact might be just the opportunity for an attacker to chain a PHP RCE with kernel LPE for some common syscall, rather than mass loss of every user's data to the attacker. I raised some PHP web application specific ideas in another thread at [1] but the answer to this question is product-agnostic and should consider microservices architecture vs. monolithic web application with access to everything, and use case/requirements development that considers matters such as users wanting to isolate their own access. For example, allowing bank users read only login for bank accounts vs. separate login for making transfers. Or implementing business process changes such as delayed commit for sensitive user actions--e.g. force delay a bank transfer by 24h and notify the user via various means giving them a chance to undo the transfer before they no longer can.
- How can I keep up-to-date with the latest software/system security architecture trends? What is the equivalent of [2] for learning about architecture patterns to potentially use for a simple eCommerce site, HR/finance web application, etc in 2026? For components of a web application such as interpreter, database server, etc--what options exist for each and how good is the project's choice of software languages, dependencies, etc to offer the strongest security protections in 2026? When was the last time I checked if someone had written an interpreter for PHP, Python, etc in Rust, SPARK, or whatever, or written an interpreter with much more comprehensive unit testing included?
- How quickly can my users or I detect security incidents / deviations of system behaviour from typical state? For example, [3] was discussed on HN today as once such detection mechanism where canary tokens are deliberately littered throughout a system or dataset. The security incident may have already happened, but early detection forces an attacker to burn their vulnerability chain quickly on their most highly prized target and not be able to use it against a mass of targets over a long duration of time.
[1] https://news.ycombinator.com/item?id=50184239
[2] https://aosabook.org/en/index.html
[3] https://news.ycombinator.com/item?id=50185630