After the recent vulnerabilities in PHP, Brotli and the Linux kernel, I think we are going to have a lot of patching to do over the next few years. People are calling it the "vulnpocalypse", and if we keep getting weeks like this, many organisations are going to struggle to keep up.

Finding and fixing bugs is a good thing, but someone still has to deploy the fixes. If that takes weeks in your organisation, now is a good time to work out why. As Martin Fowler put it in Frequency Reduces Difficulty: "If it hurts, do it more often".

I thought I would share a few ways to make things easier:

1. Start by automating patching. As I wrote in vulnerabilities are cattle, not pets, I would rather spend time making updates easier than repeatedly debating which bugs deserve fixing. Agents can prepare upgrades, review changes and investigate failures in isolated environments without production credentials. Use cooldowns for routine updates, with a faster route for urgent fixes. Verify that the fixed build and bundled dependencies are actually running, including any necessary restarts.

2. Add more tests, and use AI to help write them, especially around code people are afraid to change. Cover important functionality and security boundaries. Check what the tests actually verify, particularly when an agent writes both the code and its tests.

3. Run tests in production using dedicated accounts and controlled data to catch failures caused by the real environment. Plan recovery too: rolling back a security update can restore the vulnerability, so you may need a temporary mitigation.

4. Look at dependencies you barely use, starting with functionality you can remove entirely. For a small helper, replacing a dependency with simpler, tested code may be worthwhile. Make sure you are reducing complexity, and remember that you now own its maintenance and future fixes.

5. Spend some time and tokens on pre-emptive reviews of the dependencies and other third-party code you rely on. Someone who finds a zero-day may keep it private, or publish it at the worst possible time for you. Auditing that code yourself gives you a chance to find and fix bugs earlier. Budget for validating findings and getting fixes deployed, whether that means working with maintainers or maintaining a local patch.

And every time you go through a patching campaign, ask yourself what was hard, what took time, what we can automate and what we can get an agent to do for us.