Two hours from a PHP website to the domain hashes
On 21 October 2026 CISA asked for something nobody writes lightly: anyone who cannot patch PHP immediately, or who is still on 8.1 or earlier, should take their PHP-based systems off the network. These are CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on CVSS v4.0, and the details leaked before the patch existed. But the door is not what interests us: in the case Unit 42 documents against a European government entity, two hours passed between the break-in and the password hashes, the MFA secrets and an NTLM tunnel into Active Directory. PHP did not open that path. With the branch table, the mitigations that do not mitigate, and the twenty-minute check.
Microsoft 365
ES 
CAT 
EN