Expert ArticlesAI Governance & Ethics
PHP Vulnerabilities Highlight Why Patching Alone Is Not Enough to Stop Attackers
Article content
Recent attempts to exploit two leaked PHP vulnerabilities have renewed attention on the need for organisations to move beyond emergency patching and examine whether attackers have already gained access to their systems.
Spencer Young, SVP International at cybersecurity company Delinea, highlights why applying security updates is only the first step. Organisations must also investigate possible breaches, protect credentials that may have been exposed and restrict access to prevent attackers from moving deeper into their environments.
Expert Commentary: Spencer Young, SVP International, Delinea
“Organisations are racing to apply these emergency security updates before any damage is done. While essential, it's only half the battle - they also need to check whether attackers have already been inside.
“If attackers have already exploited these weaknesses, they may have gained access to passwords or digital keys that could allow them back into the system, even after the flaws have been fixed. It means the security risk could still be there long after the immediate threat has been addressed and attackers could retain a way back in, waiting for another time to strike.
“If attackers have got in, the damage they could do depends partly on what they can reach. Getting into a website shouldn't mean getting access to everything behind it. Limiting what each person or system can access helps stop one break-in spreading across an organisation.”
Why patching must be followed by access security
Spencer’s commentary highlights a critical challenge for security teams: fixing a vulnerability does not automatically remove an attacker who may already have exploited it. Organisations need to review system activity, investigate signs of unauthorised access, rotate potentially compromised passwords and keys, and revoke suspicious sessions or credentials where necessary.
The incident also reinforces the importance of least-privilege access, which limits users, applications and systems to only the resources they need. By reducing unnecessary access and securing privileged credentials, organisations can help contain the impact of an initial compromise and make it harder for attackers to move laterally through their networks.
For the wider technology and cybersecurity industry, the lesson is clear: vulnerability management must be part of a broader security response that combines timely patching, breach investigation, credential protection and continuous access controls. As digital environments become more interconnected, resilience depends not only on closing known weaknesses but also on identifying and containing threats that may already be inside.
About Delinea
Delinea is a cybersecurity company focused on securing identities and controlling access to critical systems, applications and data. Its solutions help organisations manage privileged access, protect credentials and reduce identity-related security risks across modern IT environments.
Source and Credits
Expert: Spencer Young, SVP International, Delinea
Source: Commentary provided by Hotwire Global on behalf of Delinea.