Global PHP Security Scare Highlights Why Stealth Matters in Cyberspace

Critical cybersecurity vulnerabilities recently made headlines, prompting warnings from U.S. and international security agencies. The incident highlights a defensive principle familiar to military aviation: reducing an adversary’s ability to detect and engage a target can be just as important as defending against an attack. We take a closer look at the similarities between the two domains.

On Oct. 21, 2026, the disclosure of two critical vulnerabilities in PHP, one of the world’s most widely used programming languages for web applications, sent media into a frenzy and triggered widespread concern, prompting urgent warnings from government agencies, security researchers and technology vendors.

Tracked as CVE-2026-109618 and CVE-2026-109619, and collectively nicknamed “PHP2Shell,” the vulnerabilities received a critical CVSS 4.0 severity score of 9.2. Successful exploitation could allow an unauthenticated attacker to remotely execute malicious code on affected servers, potentially gaining control of the systems. Once compromised, a targeted server could be used to access sensitive data, move laterally across the victim’s infrastructure or launch further attacks.

PHP powers millions of websites and web applications and is also the language behind popular content management systems such as WordPress, Drupal and Joomla. For this reason, the potential implications of the vulnerabilities extend well beyond ordinary websites.

The U.S. National Security Agency (NSA) issued a dedicated advisory warning that the vulnerabilities could affect government infrastructure and calling for immediate patching across federal departments and agencies. The NSA also confirmed it was working with the intelligence community and the Cybersecurity and Infrastructure Security Agency (CISA) to identify and address potential vulnerabilities affecting U.S. Government and National Security Systems.

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately.

If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates.

The FBI urges organizations to take the following steps now:

If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

Immediately update affected PHP installations following the guidance on https://t.co/JFOW6jG9Ws. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/ZWC7Se2YdU. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on https://t.co/JFOW6jG9Ws, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

— FBI (@FBI) October 23, 2026

Similar advisories were issued by cybersecurity and government authorities in several countries, while companies and organizations worldwide rushed to patch their systems or, in some cases, take vulnerable websites offline. In a post that went viral on X, even the Japanese PM urged people to upgrade their sites on PHP.

皆様に、今夜に対応して頂きたい大至急のお願いです。

多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。

公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。

修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。

国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

— 高市早苗 (@takaichi_sanae) October 21, 2026

At the time of writing, no successful compromises have been publicly confirmed, although several exploitation attempts have been reported, some dating back to Oct. 17, four days before the vulnerabilities were publicly disclosed.

However, this does not necessarily mean that no compromises have occurred. Cyber intrusions can remain undetected for extended periods, either because malicious activity evades security controls or because attackers deliberately maintain a low profile after gaining access to a system, waiting for the right moment to launch the next phase of an operation.

Moreover, even when a compromise is discovered, it may not immediately become public knowledge. While various regulations impose incident reporting and disclosure obligations, these do not always translate into public announcements. This is particularly relevant to defense and intelligence organizations, where operational security and national security considerations may restrict what information can be disclosed and, above all, when.

Regardless of whether the vulnerabilities have been successfully exploited, the latest cybersecurity scare raises a broader question: what if some of those vulnerable systems had never been directly exposed to potential attackers in the first place?

Interestingly, the answer involves a concept that has become so iconic that it has transcended the world of military aviation and entered the public consciousness: stealth.

Stealth: A Lesson From Military Aviation

If you are reading this story, stealth is probably nothing new to you. Many of today’s most advanced combat aircraft, as well as several next-generation designs, incorporate low-observable (LO) features intended to reduce their detectability, particularly by radar, and in some cases across other portions of the electromagnetic spectrum.

The goal of stealth is not necessarily to prevent detection under every possible circumstance, but to make it much more difficult for an adversary to detect, track, identify and engage an aircraft.

In fact, a stealth aircraft is not invisible or invulnerable as it can still be detected, including by electro-optical or infrared sensors.

View of an F-117A Nighthawk as it flies above the Nevada desert. This frontal image clearly shows the usage of faceted angular panels instead of blended and rounded shapes to achieve a low radar cross section. Special grates covering the intakes are also visible in the image as well as the distinctive ‘V’ tail. | Source: United States Air Force/Staff Sgt. Aaron D. Allmon II An aircraft that is difficult to detect can force an opponent to operate with less information, reduce the effective engagement envelope of enemy air defense systems, complicate targeting decisions and potentially gain valuable time to accomplish its mission.

Of course, low observability is only one component of survivability. Electronic warfare, situational awareness, tactics, countermeasures and other defensive capabilities remain essential. Stealth does not eliminate every threat, but it can significantly reduce the opportunities available to an adversary.

In other words, rather than relying exclusively on the ability to detect and defeat an incoming threat, stealth aims to reduce the opportunities for an enemy to initiate an effective engagement in the first place.

And this is where military aviation and cybersecurity have something in common, more than one might initially think.

The Cyber Equivalent of Stealth

Traditionally, securing an Internet-facing application or making private applications available to remote users has often meant protecting a service that, directly or through an access gateway, remains accessible to potential attackers.

Firewalls, intrusion prevention systems, web application firewalls and other traditional security technologies are deployed to identify and block unauthorized or malicious activity. However, they may operate in an environment where the protected application or its Internet-facing access gateway, such as a VPN (Virtual Private Network) concentrator, is still discoverable and reachable by potential attackers.

An attacker can identify an exposed application or gateway, determine which technologies it uses, probe it for weaknesses and attempt to exploit a vulnerability. Even without exploiting a software vulnerability, attackers may still disrupt the availability of an exposed service through Distributed Denial-of-Service (DDoS) attacks, overwhelming it with malicious traffic or large volumes of seemingly legit requests.

While public websites, such as the one you are reading, must remain accessible from the Internet, many organizations still rely on Internet-facing VPN gateways to provide remote users with access to private applications hosted on internal networks.

For these applications, rather than relying exclusively on defending the access gateway against incoming attacks, organizations can design their infrastructure so that services that do not need to be publicly accessible are not directly reachable from the Internet.

In other words, instead of relying exclusively on the ability to detect and defeat an incoming cyberattack, organizations can reduce the opportunities for an attacker to initiate one.

Some implementations of the so-called Zero Trust model take this approach by eliminating the need for customer-managed, Internet-facing VPN gateways. Through outbound-only connections initiated from within the protected environment, these architectures allow authorized access to internal applications without exposing those applications to unsolicited inbound connections, significantly reducing the attack surface available to external attackers.

Reducing the externally exposed attack surface is, in some ways, the cyber equivalent of reducing an aircraft’s radar observability. In both cases, the objective is to deny an adversary opportunities to discover and engage a target.

Obviously, just as a stealth aircraft can still be detected and targeted, reducing the external attack surface does not make an organization invulnerable. Publicly accessible services still require appropriate security controls, vulnerabilities must still be patched, and other attack vectors remain possible.

Protecting digital infrastructure requires multiple layers of security, just as protecting a combat aircraft requires much more than just stealthiness. Still, in both environments, survivability depends not only on the ability to withstand or counter an attack, but also on reducing the adversary’s opportunities to initiate one.

And this is the reason why stealth matters in cyberspace, too.

Close up of the upper surface of the B-21. | Source: U.S. Air Force