S0E59 - Unit 42 Confirms Active PHP Exploitation — And Attackers Already Have Domain Admin

Jake Williams and Jess Hebenstreit follow up on last episode's prediction: Unit 42 has now confirmed active exploitation of the two critical PHP vulnerabilities in the wild, with attackers reaching domain admin within hours of initial compromise. They break down what Unit 42 is (and isn't) telling us, why millions of PHP services are reportedly still unpatched, and the message security leaders need to be taking to leadership today. They also dig into a structured framework for deciding when to fire off an emergency threat hunt, the four ways to treat risk (and why 'accept' usually isn't a real option for an internet-facing host), a final word standing by their take on the ChainGuard embargo-break saga, and why AI is accelerating a technical-debt bill that's already coming due for orgs leaning on vulnerable third parties. Topics covered: - Unit 42's confirmation of active, agentic-assisted PHP exploitation in the wild, including domain admin compromise within hours - How many PHP services are still exposed, and why that number matters - A repeatable framework for deciding when to run an emergency threat hunt - The four ways to treat risk — avoid, mitigate, accept, transfer — and why 'accept' rarely holds up for an internet-facing PHP host - A final word standing by their take on ChainGuard's CEO breaking the coordinated disclosure embargo - Why AI-driven acceleration is making technical debt a bill that's coming due faster than orgs can budget for it - Third-party risk management: deciding which vendors you can't afford to stay exposed to