Impart says its AI harness builds virtual patches outside traffic path

What happened

According to Help Net Security, Impart Security has launched the Runtime Defense Harness, which the article describes as a controlled environment where AI agents write and test virtual patches for new vulnerabilities. Impart says AI is not placed in the live traffic path. The article reports Impart’s description: agents build each virtual patch against the customer’s own traffic, an engineer approves it, and Impart’s Layer 7 engine enforces it inline as deterministic WebAssembly.

Impart claims security teams can get a tested virtual patch as soon as 60 minutes after disclosure. Help Net Security reports Impart’s three stated controls: scoped, just-in-time agent access with tiered autonomy (block mode and live rule changes need an engineer’s approval), programmable enforcement (versionable code that can be rolled back), and an audit trail of agent actions. Impart says teams can use its own lightweight model or bring models from Anthropic, OpenAI, Azure, or Google.

The article also cites Impart’s account of two disclosures. Impart says the first exploit attempt for the PHP2Shell vulnerabilities came four days before researchers disclosed them in October, and that nearly 80% of 4.38 million internet-facing PHP services run unsupported versions. Impart also says that for a high-severity Node.js vulnerability that could allow remote code execution (CVE-2026-111497), its customers had a blocking virtual patch within 24 hours, while a leading CDN’s rules arrived four days later in log-only mode.

What is not confirmed: the source is a single industry news item that relays Impart’s own statements. No independent testing, customer confirmation, or third-party verification of the timing claims is given. The CDN is not named. Affected versions and fixed versions for CVE-2026-111497, and technical details of PHP2Shell, are not confirmed in the source.

Am I affected?

This is not a vulnerability in Impart’s product. It matters mainly if you run PHP or Node.js services and are weighing virtual patching tools.

• If you are an Impart customer, the source gives no details on availability, pricing, or rollout of the harness: not confirmed.
• If you run internet-facing PHP services, Impart claims many run unsupported versions. The source does not say which versions are meant: not confirmed.
• For CVE-2026-111497, the source describes it as a high-severity Node.js issue that could allow remote code execution. Affected versions, fixed versions, and whether it is exploited in the wild are not confirmed.

What to do now

1. Look up CVE-2026-111497 on NVD and the Node.js project’s own advisories to confirm whether your versions are affected, since the source does not list them.
2. Check whether your PHP and Node.js services run supported versions, because Impart itself says a patch release is not protection for unsupported versions.
3. If you are considering Impart or a similar virtual patching tool, ask the vendor for evidence of the claimed 60-minute and 24-hour timelines and test any generated rule in a non-production environment first.
4. Keep human approval in the loop for any rule that blocks traffic, as Impart says its own design requires.

Sources

• Help Net Security: Impart uses AI to build virtual patches without putting models in the traffic path