The Brief · Issue # 5
Good evening,
A change from this issue: The Brief now arrives every other Tuesday, and the next issue lands on Tuesday 17 November. The format is unchanged and the bar is higher, since each issue now clears a fortnight of noise rather than a week's. Same five minutes.
Two flaws in a code path present since PHP 5.4.0 were found with AI help and patched on 21 October. Within hours governments were taking their own sites offline, and proof-of-concept exploits were already circulating. This issue is about the figure that week exposed: the hours between a fix existing and your estate being fixed.
▪ THE SIGNAL
What happened. On 21 October the PHP project released emergency fixes for two critical flaws allowing unauthenticated remote code execution on any PHP installation serving web requests (PHP). It said no complete mitigations existed. Cloudflare puts PHP behind almost 70% of websites (Cloudflare). Security firm Calif reported the first flaw in August under OpenAI's Patch the Planet programme, credits the findings to itself, OpenAI and Wiz, and says it used only generally available models (Calif). On the day of the patch the US National Security Agency advised organisations that could not update at once to take systems offline (NSA). Engadget reported government websites taken down as a precaution in the Netherlands, Denmark, France and Finland, citing Reuters, and in Canada (Engadget). Amazon logged an exploit attempt against its sensors on 17 October, four days before disclosure, and proof-of-concept exploits from about 02:00 UTC on 21 October, twelve hours before the release (AWS). On 26 October CISA added both flaws to its catalogue of known exploited vulnerabilities (CISA). By 3 November, Singapore's Cyber Security Agency reported, Palo Alto Networks had confirmed active exploitation against internet-exposed management interfaces of its firewalls, and products from Cisco, Citrix, F5 and Siemens were also affected (CSA).
In a system-card addendum dated 26 October, OpenAI said it treats GPT-6.1 Terra as Critical capability in cybersecurity, as it did GPT-6 Astra (OpenAI). On 28 October Google announced Gemini 4 Carbon and said it would go first to a subset of cyber defenders (Google).
The analysis. Three things changed in one week, and none of them is about PHP. The cost of finding a flaw in old code fell: a small firm with a commercial model found what had sat in that code path since PHP 5.4.0. The cost of turning a fix into an attack fell with it: Amazon says AI-assisted analysis makes turning a patch into a working exploit cheaper, and advises measuring patch and mitigation timelines in hours. And the developers now rate or ration their models for cyber capability, so the strongest tools are a procurement question for the defence. Our read: the exposure window, the hours between a fix existing and your estate being fixed, is now a figure a board should know, though not the whole exposure: attempts preceded the fix. "Are we patched" now has a second half: for how long were we not, and how do we know.
