Critical vulnerabilities in PHP are raising questions about how organizations can identify and secure legacy systems that may have been deployed more than two decades ago.
The flaws have reportedly existed since 2004, leaving current security teams to manage systems originally installed and maintained by personnel who may no longer be with their organizations.
Madelein van der Hout, a senior analyst at Forrester Research, had some interesting comments for TechNewsWorld and explained that what makes these vulnerabilities significant is where they sit.
“PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough.
“Organizations need to establish where they are exposed and prioritize internet-facing systems.
“This is a test of operational resilience, not just patch management,” she added.
Phillip Wylie, Chief Security Evangelist, Suzu Labs:
ㅤ
“One of the biggest challenges with vulnerabilities this old is that the people who originally deployed and maintained these systems may no longer be with the organization. Documentation may be outdated or nonexistent, and current security teams may not even know these systems are running.
“Before organizations can patch vulnerabilities, they need visibility into what’s in their environment. That means identifying affected systems, understanding their business impact, and prioritizing those exposed to the internet.
“Patching is important, but it’s not always straightforward with legacy applications. Organizations need to assess the potential impact of updates, implement compensating controls where immediate patching isn’t possible, and develop a plan to replace systems that can no longer be securely maintained.
“This is why asset management, vulnerability management, and basic security hygiene are so important. You can’t protect systems you don’t know exist.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“These PHP vulnerabilities highlight two problems. First, releasing a patch doesn’t mean we can fix everything overnight. PHP is embedded in all kinds of devices, including IoT products, where updates may depend on a vendor. And plenty of small businesses use PHP applications because they’re easy to get running. That doesn’t mean those businesses have the staff or technical expertise to keep everything updated.
“Then you have application compatibility. Plugins and other dependencies can require specific PHP versions, so updating the underlying software may break something the business relies on. ‘Just patch it’ sounds great until the update takes down your website.
“And we haven’t even gotten to the AI-assisted vulnerability research behind this. I think we’re going to see more critical vulnerabilities discovered with AI, and potentially less time between discovery and exploitation.
“That’s the part that worries me. Finding vulnerabilities faster doesn’t mean organizations can fix them faster. We’re still struggling to patch the systems we already know are vulnerable. As an industry, we’re not ready for that gap to keep growing.”
ㅤ
Noelle Murata, Chief Operating Officer, Xcape Inc.:
“The discovery of decades-old vulnerabilities in PHP presents a severe operational resilience test for enterprises rather than a routine patch management drill. At its core, this is another case of needing to “patch your stuff.” Because this runtime underpins a vast swath of the Internet and complex supplier ecosystems, the risk extends beyond primary corporate websites into forgotten legacy dependencies where original deployment context is long gone. Popular frameworks exist that are easy to deploy but also vulnerable if configured improperly. This does not necessarily mean that those frameworks are bad, but rather it is easy to deploy them poorly. Security teams must move beyond basic scanning and execute comprehensive asset discovery across all Internet-facing systems to identify shadow infrastructure. Mitigating controls exist to make this threat less severe without completely removing the risk, so there is cautious optimism that organizations can respond effectively. That said, there will undoubtedly be companies that will not respond quickly, so the number of vulnerable hosts will remain high.
“Critical Takeaways:
- Operational resilience requires mapping and securing forgotten legacy infrastructure beyond primary corporate websites.
- Mitigating controls offer cautious optimism, but the slow response from many organizations will keep the count of vulnerable hosts high.
- Vulnerabilities in popular frameworks often stem from rapid but poor configuration rather than inherent flaws in the code itself.
“Hope is not a strategy, but mitigating controls might just buy you enough time to formulate one.”
PHP needs to be patched. I would strongly recommend that you find out if ANYTHING uses PHP and take the action that is requires ASAP.
Quest Diagnostics confirms patient health records compromised in cyberattack
Posted in Commentary with tags Hacked on October 23, 2026 by itnerdQuest Diagnostics has disclosed a cyberattack involving unauthorized access to patient records, according to an October 22 SEC filing.
The company discovered the incident October 21 in its Quanum Lab Services Manager system, which healthcare providers use to order laboratory tests and access results.
Quest confirmed that personal information and protected health information were compromised but has not disclosed the number of affected patients or the specific records accessed. The Quanum platform is reportedly used by approximately 500,000 clinicians across thousands of locations in North America.
Quest suspended access to the affected system, notified federal law enforcement and engaged external cybersecurity experts.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“I hate seeing incidents like this, especially in healthcare, where some of our most personal information is at stake. Quest’s containment efforts are an important first step, but containment isn’t the finish line. The real work is establishing how the attacker got in, what they could access, whether they left anything behind, and independently verifying that those paths are closed. We don’t yet know the full scope, and keeping operations running doesn’t necessarily mean patient information is safe. In healthcare, restoring service and restoring trust are two very different tests.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“An attacker with read-level access to this system walked out with a current view of what conditions patients are being tested for and treated for across thousands of locations, but the provider side matters too. Physician names, NPIs, and ordering patterns give an attacker everything they need to run targeted phishing against the clinicians who ordered testing and diagnostics, and that could turn this breach into a staging ground for the next one.
“Breaches like this one sit in the same category as what we saw with Change Healthcare, where a single compromised vendor has reach into millions of records across downstream organizations that cannot easily switch providers.”
Another day, another company pwned. And I say it all the time which is that your company should not want to ever be the next victim. Thus you need to do everything possible to keep the bad guys out. And do it quickly.
Leave a comment »