If PHP Caught You Off Guard, How Fast Could You Find Every RSA Key?

The latest PHP vulnerabilities are a reminder that the speed of your response depends on the quality of your visibility.

In October, two critical vulnerabilities in PHP sent security teams racing to answer a deceptively simple question: Where are we running it?

The flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution on affected systems. PHP released security updates on October 21 and urged users to update immediately. The FBI also advised organizations to inventory their PHP installations, including internet-facing systems and products that bundle PHP.

Finding the obvious web servers is one thing. Finding PHP embedded in third-party products, legacy applications, and forgotten systems is another.

The immediate priority is clear: identify affected installations, apply the appropriate updates, and investigate potential compromise.

But the episode raises a larger question for every technology leader:

If PHP caught you off guard, how fast could you find every RSA key in your environment?

The next visibility challenge

PHP and RSA present different risks. The PHP vulnerabilities are software flaws that can enable an attacker to execute code. RSA is a widely used public-key cryptographic algorithm that a sufficiently capable future quantum computer will break using Shor's Algorithm, or now, thanks to AI, an optimized version of that.

What connects them is the operational challenge: both can be deeply embedded across an organization’s technology estate, often in places that are difficult to see.

RSA may support certificates, digital signatures, authentication and key exchange across applications, devices, cloud services and business partner connections. Some dependencies are visible. Others may sit inside vendor products, legacy air-gapped systems, or configurations that have accumulated over many years.

When the time comes to change them, a list of servers will not be enough. Organizations will need to know which cryptography is in use, what it protects, who owns it, and what depends on it.

That understanding takes time to build—particularly when critical information must remain confidential for years or decades.

Discovery is a business capability

The question is not simply whether an organization can deploy a post-quantum algorithm. It is whether it can find and prioritize the systems that need to change without disrupting the business.

A practical cryptographic inventory can help teams:

• Identify where RSA and other cryptographic mechanisms are in use.

• Connect cryptographic assets to the applications, services, and information they protect.

• Prioritize long-lived sensitive data and mission-critical dependencies.

• Plan migration with system owners and suppliers before a deadline becomes a crisis.

No single discovery method will see everything. Network scanning, for example, can reveal cryptography exposed through observable services, while other dependencies may require access to applications, configurations, code, or vendor information.

That is why visibility should be treated as an ongoing discipline, not a one-time project.

From reaction to readiness

At Patero, we believe cryptographic discovery is a starting point for that discipline.

Cryptographic Inventory combines network scanning and analytics to help organizations understand their cryptographic footprint and develop a data-driven migration strategy.

The PHP alert demanded a fast answer to an immediate problem. Migration to Post-quantum Cryptography allows organizations to prepare for a broader one.

The question for leadership is simple: When the next cryptographic change becomes urgent, will you already know where to look?