A critical vulnerability becomes public, but a security update isn’t available yet. Your IT team is investigating which applications are at risk. Meanwhile, services have to keep running. So how do you limit your exposure? And how do you stop an initial breach from spreading?
The recent PHP2Shell-vulnerabilities (CVE-2026-109618 & CVE-2026-109619) illustrate that challenge. Under certain conditions, they allow attackers to execute code on a vulnerable server without logging in first. Patches are now available. Even so, the window before an update is applied remains a key concern for any security strategy.
When patching isn’t possible yet, breach containment becomes all the more important: limiting an attack and preventing it from spreading further. Microsegmentation helps you build that protection in advance.
What can you do while a patch is unavailable?
As soon as a vulnerability becomes known, organisations need to act fast. First, teams map the affected systems. Then they assess which temporary measures reduce the risk.
Sometimes they can restrict access. In other cases, they have to take a vulnerable service offline temporarily. CERT-EU also recommended this isolation for PHP2Shell where organisations could not patch immediately.
But even once an update is released, remediation takes time. Teams check dependencies, test compatibility and roll out the patch. That is why the connections behind a vulnerable application also deserve attention.
Which systems can that application reach? And are all those connections really necessary?
Fewer connections, fewer attack paths
An application often communicates with databases, APIs and other services. Some connections support essential functions. Others, however, linger after a migration or a temporary intervention.
Microsegmentation restricts that communication. For each application or workload, you decide which connections to allow. This reduces the room for lateral movement: an attacker moving from one system to another CISA also highlights this benefit as part of a Zero Trust approach.
Take a customer portal that needs a single database. You allow the necessary connection and block access to other databases, backup servers and management environments.
If an attacker takes over the portal, those boundaries limit the targets within reach. As a result, the attacker cannot as easily attack other systems from that initial foothold.
Blast radius: how much damage is still possible?
Microsegmentation reduces the blast radius: the full set of systems, data and services an attacker can reach from a single compromised system. That is not the same as eliminating the risk. Whoever takes over the customer portal can still reach the database the portal is allowed to talk to, often using the credentials stored on the server.
So, for each application, determine what remains reachable in the worst case and what that means for your security. Also limit the privileges on that one permitted connection, using a least-privilege database account rather than an admin account, and filter outbound traffic. This turns the blast radius into a measurable criterion for prioritisation: start with the applications that have the largest blast radius.
Prepare the boundaries in advance
During an incident, every minute counts. Yet you cannot simply block connections. Without insight into dependencies, you also risk disrupting essential business processes.
That is why microsegmentation starts before the next vulnerability. First, map the connections between applications. Next, have the application owners confirm which communication they need. Then test the rules before you enforce them.
This way, you build clear boundaries step by step. That preparation also helps your teams intervene more precisely during an incident. They know which connections are essential and which they can shut off.
Microsegmentation does not replace the patch
Microsegmentation does not fix a software flaw. An attacker can still attack a publicly accessible application. They may also try to abuse permitted connections. Data on the affected server therefore remains at risk.
Security updates, restricted access rights and monitoring therefore remain essential. Suspect a breach? Then your team also needs to investigate what happened and which systems or data the attacker reached.
At ACEN, we therefore see microsegmentation as a structural part of digital resilience. The approach helps organisations limit attackers’ room to manoeuvre, even when technical remediation is still some way off.
