04 / Improve

Vulnerability Management

AI is compressing the time between vulnerability discovery and exploitation. Find exposure, prioritize fixes, and act quickly to protect your systems.

Rapid response

Hunting one threat,
we found another.

Real response

Less than 24 hours after two critical PHP flaws were disclosed, Karhu Cyber completed a threat hunt across thousands of managed systems. We found no exploitation, but we found something else.

Tuesday, October 20
PHP2Shell flaws disclosed
Wednesday, 3 PM ET
Hidden password exposure found
Wednesday, 5 PM ET
Fleet-wide hunt complete

The threat

PHP2Shell is two critical flaws in PHP that can let an attacker with no login run code on servers that handle web requests. Exploitation attempts began before any patch existed, so we hunted for signs of compromise instead of waiting on patch reports.

CVE-2026-109618
CVE-2026-109619
CVSS 9.2

What we did

We hunted across thousands of managed systems, checking every system with PHP installed for signs the flaws had been used. We reviewed everything the hunt surfaced, not only PHP2Shell indicators. We also guided clients through upgrades and patching, or managed that work on their behalf, to mitigate the critical vulnerabilities on exposed systems.

For business leaders

Uptime. Data. Customer trust.

PHP is part of the software behind many business websites and customer portals. On affected systems, these flaws could let an attacker run malicious instructions without signing in. That could mean interrupted services, stolen data accessible to the application, or altered website content—with consequences for revenue and customer trust.

The business priority was to close that exposure quickly while keeping services available. Karhu combined threat hunting with upgrades and patching, helping clients address the risk while their websites stayed online outside the patch window.

PHP security advisory

What we found

Clear

No PHP2Shell exploitation

Timely threat hunting paired with vulnerability management helped us identify exposed systems and mitigate the flaws before attackers could exploit them. We found no evidence of exploitation on any vulnerable system. Our clients’ websites stayed online outside the patch window.

Found

A certificate password in the logs

What we saw: At 3 PM, midway through the hunt, a web application on one client system passed a certificate password in plain text to a Windows certificate tool. Windows and security tools record full command lines, so the password was sitting in the client's logs.
Why it matters: Anyone who can read those logs can read the password without touching the application. With the password and a copy of the certificate, an attacker could pose as the service it protects or sign in as that identity.
Misuse check: We found no sign anyone accessed or used the password.
What we did: Karhu gave the client a plan to rotate the certificate, load it without a command-line password, purge or lock down the logs that captured it, and alert on any repeat.

Under 24 hoursFrom disclosure to fleet-wide hunt complete

ThousandsManaged systems hunted

0Systems exploited

1Exposed credential found, no sign of misuse

Why it matters

A thorough hunt reviews everything it touches. Looking for one threat surfaced a quieter risk that had been sitting in plain sight.

Attack techniques (MITRE ATT&CK)

No attacker activity was observed. These techniques describe the vulnerability we hunted for and what the exposed password could enable.

Exploit public-facing applicationT1190
Unsecured credentialsT1552
Steal or forge authentication certificatesT1649
Valid accountsT1078

Real response. Details changed to protect our client.

Focus remediation where it matters most.

A long list of vulnerabilities is only a starting point. We help connect findings to exposed systems, critical services, and remediation owners so your team can make steady progress.

Recurring vulnerability discovery
Risk-based prioritization
Remediation coordination and tracking
Trend reporting and follow-up validation

AI and the urgency of remediation.

As advanced AI tools become more capable and widely available, attackers can find vulnerabilities and develop exploits with less time and effort. Future advances toward superintelligence could increase this pressure further. Ongoing discovery, prioritization based on actual exposure, and timely, verified remediation help reduce the window attackers have to act.