It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them.

The issue is where to direct the LLM's attention.

Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.

Or, you know, use client certificates so the bots can’t hit you.

Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.

It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.

Yes, so who will pay for that? Open source so far meant you would use your brains and your creativity, now you need to use your money too if you want to keep pace. From a 'guts, credits & glory' proposition to 'slop processor if you can afford it' is not really an upgrade.