“I think that’s the part we keep getting wrong as an industry. We measure ourselves on patch speed, which is easy to count, and spend far less effort asking whether we’d notice a compromise that already happened. An attacker with code execution on a web server doesn’t stay there. They look for stored credentials, try a few accounts, and move to something more valuable. Each step looks fairly ordinary alone. A server making an odd outbound connection or a service account logging in from somewhere new is easy to dismiss until you see the two together. The teams that handle these events well are the ones who treat the exploit as the start of the story, and they judge their servers and accounts against what normal looks like for each of them.”

News of the PHP2Shell vulnerabilities has caused a stir in the cybersecurity world, with Ben Ronallo, Principal Cybersecurity Engineer at Black Duck, calling the flaws’ announcement “a genuine drop-everything moment.”