Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10. On today's Breach Please, Richy fills in for Jake and joins Jess to break down why these bugs hit vendor appliances hardest, how to actually hunt down PHP you didn't know you had without a reliable CMDB, and their one real disagreement: wait for the CISA KEV, or patch now if you're internet-facing?
Watch: https://youtu.be/ocIIAfLlfIM