A headline that names software now searches your estates
PHP's maintainers published fixes for two 9.8 remote-code flaws, and our briefing listed the headline and stopped there. From today a headline or a CVE that names software becomes a probe: the briefing searches every client's machines for it, names the versions against the fixed releases, and asks the machines themselves every six hours.
The maintainers of PHP today published 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing two remote-code flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.8. Wiz, which found one of them, says every PHP of the last decade is affected.
Our security briefing picked up the headline within the morning and listed it under "In the news". Then it stopped.
Tenants running PHP heard nothing further, because three things were all true at once: the news matcher reads product families, and PHP is a runtime; alerts fire on CISA's exploited catalogue, and an hours-old CVE is not in it; version-against-fixed-release knew only the browsers.
That gap is closed from today. A headline or a CVE that names software now becomes a threat-response probe: the product we name, the names it installs under, the fixed releases per line, and the headline that triggered it.
The probe searches the inventories the agents already sent. The briefing shows a Threat response card with the machines, the versions seen, the CVEs and the headline.
Every six hours the confirmation asks the candidates themselves. Online machines with a cached match get a fixed osquery question over the fleet broadcast - which packages they carry under those names - and the card says what answered: still installed on 2 of 3, say, with the live versions beside the cached ones.
Locked tenants are asked too. A read-only presence check is not the new work the plan rule withholds, and telling an MSP that a critical flaw sits on its machines is the product's job.
The card judges the inventory. The live answer stands beside it as a report.
Versions carry their marks - older, fixed, or shown unchecked where a distribution's own package makes judging impossible, since its fixes arrive as backports under the old number.
It says installed, and it stops there. The fixed releases come from NVD or the vendor as written down when the probe was made, and that is not the same as calling a machine vulnerable.
It does not alert, and it will not join the digest. A probe is our own question. It is not CISA's catalogue. It lives thirty days and leaves the page when its window ends.
What the card cannot see is what the inventory cannot: software installed from a tarball or running in a container doesn't land in package lists, so a probe can miss a PHP that answers on a port.
The running check is the next slice. Until then the card is a search of what's installed. It is not a scan of what's listening.