When CERT-EU advised organisations unable to patch two critical PHP flaws to consider taking their websites offline, several European governments took the unprecedented step of doing exactly that. The patch arrived shortly after, but the sequence of events highlighted a glaring reality in modern cyber security: the hard part is rarely the patch itself.
The true challenge for most organisations was answering a seemingly simple question quickly: where exactly do we run PHP?
While your primary corporate website is an obvious starting point, enterprise digital footprints are vastly more complex. PHP powers roughly 70% of the web, underpinning major platforms like WordPress, Drupal, and Magento. The exposure often lies in the shadows: the careers microsite an agency built in 2019, the legacy event registration page, the customer portal hosted by a supplier, or the isolated marketing environment spun up for a specific campaign and subsequently forgotten.
Because these vulnerabilities affect every PHP version from 5.4 onwards, relying on the assumption that an environment is running an older, stable version does not offer protection; it merely guarantees exposure. According to guidance from the 🔗National Cyber Security Centre (NCSC), robust vulnerability management is impossible without comprehensive asset discovery.
The Visibility Deficit
If a security team requires more than an hour to produce a complete, accurate list of exposed digital assets during a zero-day crisis, that delay is the primary security finding, not the CVE itself.
Modern cyber security requires moving beyond static spreadsheets. At Mondas, we leverage AI-driven discovery tools and best-in-class software to ensure continuous visibility, transforming asset inventory from a periodic audit into a live, operational capability.
Leadership teams and security owners must address three critical questions immediately:
- Do we maintain a live inventory of every internet-facing application, including those hosted by third-party vendors?
- Who holds the explicit authority to take a public-facing site offline during a critical incident, and how rapidly can they execute that action?
- Which of our supply chain partners have confirmed their patching status in writing?
If any of these questions prompt hesitation or require days of investigation, your incident response capabilities are operating with a critical blind spot.
Lance Nevill Cyber Security Director 🔗linkedin.com/in/lancenevill
Mondas specialise in comprehensive asset visibility and rapid vulnerability management. If you are struggling with the digital footprint and exposure issues outlined in this article, contact our team today to regain control of your attack surface.
Article First Published October 23, 2026
