01
Item one. PHP web services: verify the fix is running, then assess prior exposure
Item one. PHP web services: verify the fix is running, then assess prior exposure. PHP is the software that handles web requests for many applications, so the relevant estate includes PHP-FPM, Apache mod_php and products that bundle PHP. Two critical flaws can let an unauthenticated remote attacker execute code in a vulnerable web-serving process. The PHP project released fixes October 21; CISA added both flaws to its Known Exploited Vulnerabilities catalog October 26, raising the priority for exposed assets. Separately, a researcher reported 35 shell launches across three deliberately vulnerable honeypots on October 24. Those were decoys using a particularly favorable single-worker Apache mod_php setup—not evidence of attacks on our systems or a measure of success elsewhere.
Ask the platform owner today for an inventory of internet-reachable services using PHP, including containers and bundled products, and a named owner and completion date for every unverified exception. Request evidence that the vendor-corrected package or backport is installed and that active workers are serving the fixed code; distributions may backport fixes, so a version string alone can mislead. This closes the exposure question. If logs or other evidence suggest earlier access, open a separate incident investigation: patching prevents the vulnerable path from continuing, but can’t establish that no one used it before.