Our advisory TA-2026-1021-001 recommended upgrading all PHP runtimes to a fixed release. Where that cannot happen straight away, for example because of change freezes or vendor dependencies, this supplement sets out the temporary measures that reduce the risk, why each one helps and how to confirm it has worked. They reduce exposure to the attack methods demonstrated so far but do not repair the flaws in PHP, so they should stay in place for days, not weeks.

In February 2026, Gartner named a new category: Preemptive Exposure Management. It is defined as technology that systematically disrupts and denies adversary behaviour, automating attack-path identification and simulating adversary behaviour to close exposures before they are weaponised. By 2029, Gartner expects 60 percent of organisations to have adopted structured exposure validation, but only 30 percent to have connected those results to automated remediation. The validation gate gets built well before the interdiction gate—and that is the gap this paper addresses.