Skip to content
Sign in
Artwork for AI Literacy for Leaders
AI Literacy for Leaders · Friday · 5 min

Special Edition: You Cannot Patch What You Cannot Name

The NSA does not issue patch advisories to fill a slow news day. On October 21, 2026, it warned about a set of flaws in PHP, nicknamed PHP2Shell, that could let an attacker take control of an affected web server with no login and no prior access. PHP released its patch the same day. In this special edition, Laurence Gill, a federal IT leader who began his career at the Government Accountability Office, explains why the hardest part of this advisory is the inventory. PHP hides inside vendor products, legacy services, and tools nobody has owned in years, and end-of-life services cannot take the patch at all. That is an asset management problem and a decision rights problem, and it sits with leadership. In this episode: What NSA is asking organizations to do now: inventory, prioritize patches, add logging, and replace or take offline anything that cannot be patched Why you cannot patch what you cannot name Who should own the decision when a service cannot take the patch A one-day test you can run with your CIO or CISO on Monday Read the NSA advisory: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/ Subscribe to AI Literacy for Leaders for practical governance guidance for executives navigating real AI decisions.

0:00-5:52
Play in

transcript

No transcript — this publisher did not publish one.

show notes

The NSA does not issue patch advisories to fill a slow news day. On October 21, 2026, it warned about a set of flaws in PHP, nicknamed PHP2Shell, that could let an attacker take control of an affected web server with no login and no prior access. PHP released its patch the same day.

In this special edition, Laurence Gill, a federal IT leader who began his career at the Government Accountability Office, explains why the hardest part of this advisory is the inventory. PHP hides inside vendor products, legacy services, and tools nobody has owned in years, and end-of-life services cannot take the patch at all. That is an asset management problem and a decision rights problem, and it sits with leadership.

In this episode:

  • What NSA is asking organizations to do now: inventory, prioritize patches, add logging, and replace or take offline anything that cannot be patched
  • Why you cannot patch what you cannot name
  • Who should own the decision when a service cannot take the patch
  • A one-day test you can run with your CIO or CISO on Monday

Read the NSA advisory: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/

Subscribe to AI Literacy for Leaders for practical governance guidance for executives navigating real AI decisions.

links1

more episodes

All episodes