S0E59 - Unit 42 Confirms Active PHP Exploitation — And Attackers Already Have Domain Admin
Jake Williams and Jess Hebenstreit follow up on last episode's prediction: Unit 42 has now confirmed active exploitation of the two critical PHP vulnerabilities in the wild, with attackers reaching domain admin within hours of initial compromise. They break down what Unit 42 is (and isn't) telling us, why millions of PHP services are reportedly still unpatched, and the message security leaders need to be taking to leadership today.
They also dig into a structured framework for deciding when to fire off an emergency threat hunt, the four ways to treat risk (and why 'accept' usually isn't a…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.