Cybersecurity Awareness Month: The 3Rs of Cybersecurity
We’ve made it to the final week of Cybersecurity Awareness Month! After last week’s focus on incident response, we’re closing out the month with three habits called the 3Rs of Cybersecurity: Reduce, Replace and Recover.
Real-World Examples of the 3Rs
Throughout this post, we’ll be using the recent PHP2Shell vulnerabilities as a topical example to illustrate the concepts. Follow along to learn why each one matters!
1. Reduce Attack Surfaces
Think of your organization like a house. Every internet-facing server, open port, and forgotten test system is another door or window an attacker can try. The fewer doors and windows you have, the more secure your locks are, and the sooner you repair/replace them when you find out about a manufacturer recall, the less likely you are to come home and find your TV is missing.
This month’s PHP exploitation is an example which accentuates why reducing your attack surface is so important. PHP is the back-end server code behind almost 70% of internet websites.
On October 20th, details of two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”) leaked online before a patch existed. Both let an unauthenticated attacker run code remotely on a web server.
Developers behind PHP rushed out fixes the next day, but Amazon’s threat intelligence team reportedly saw exploitation attempts as early as October 17th and Palo Alto’s Unit 42 counted more than 22 million potentially exposed instances.
Following the announcement of PHP2Shell and the extreme risk of exploitation, many websites around the world were taken offline for emergency maintenance. This is one way organizations could (temporarily) reduce their attack surface until the corresponding fixes had been implemented.
Reducing exposure isn’t just about making a system temporarily inaccessible, though. Perhaps some of these websites didn’t need to be public-facing in the first place and could only allow connections from known and trusted source IP addresses, such as the organization’s VPN for an internal web app.
Returning to our house analogy, this would be like using a window bar or wedge lock to let in fresh air without being open enough for a burglar to climb through. Even in situations where you can’t fully isolate a system, there are ways to reduce its exposure to attackers!
2. Replace End-of-Support Devices
In the example above, website maintainers were able to take their sites offline temporarily while they installed a patch, but patching only works if a patch exists in the first place. Every piece of software and hardware has a finite lifetime, the end of which is marked by an End-of-Life (EOL) date when it will no longer be made available by the vendor.
Often (but not always!), an EOL date is followed by an End-of-Support (EOS) date, until which time systems may continue receiving security updates but no new features. Software and hardware past their End-of-Support date stop getting security fixes, so every new flaw stays open permanently.
Returning to PHP2Shell, the PHP project issued fixes for its supported branches, but PHP 8.1 and older were left without an update. This is why it’s crucial to phase out end-of-support systems: to ensure they aren’t left exposed!
In February, CISA issued Binding Operation Directive 26-02, which ordered federal agencies to remove end-of-support edge devices such as firewalls, routers, and VPN gateways. It cited widespread exploitation campaigns by advanced threat actors.
Regardless of whether you’re impacted by this federal mandate, you should regularly ask the question: what is no longer supported in this environment? Don’t forget to include systems which have upcoming EOL/EOS dates (see our post on the Windows 10 EOL in 2025).
From there, develop a plan of action to replace end-of-support devices to keep your systems from becoming frozen in time without any future updates!
3. Recover Quickly to Sustain Operations
PHP2Shell also illustrates why recovery planning matters. Details leaked before a patch existed and exploitation attempts were reportedly seen days before fixes shipped.
In response, Cloudflare rapidly deployed mitigations for their web application firewall (WAF), SiteGround disabled the affected functionality until the fix arrived, and, as mentioned above, many organizations took services offline entirely while they performed patching.
Teams will be particularly effective if they have practiced response activities like isolating a server, rebuilding from a known-good copy, and keeping critical services running in the meantime. This is the outcome of building muscle memory as we discussed in last week’s post about incident response planning, so exercise it before it becomes necessary!
Your Checklist for the 3Rs of Cybersecurity
Use these quick tips below to help as you go forth and implement the 3Rs:
Reduce: Inventory what’s exposed, limit what’s publicly accessible, and patch critical flaws quickly.
Replace: Check support dates (past and upcoming) and plan to retire anything vendors have stopped supporting.
Recover: Test your incident response processes, verify your backups, and rehearse running without your primary systems to ensure you’re prepared when it hits the fan.
Closing Thoughts for Cybersecurity Awareness Month
This month, we’ve covered critical cybersecurity topics to help you navigate the (sometimes murky) waters of cyber threats and how to protect yourself. From Covering Down the Basics, we Leveled Up Our Defenses and Went the Distance.
Now, armed with a list of how to implement the 3Rs of Cybersecurity and having a recent real-world example justifying how important they are, you can leave this Cybersecurity Awareness Month with confidence and newfound knowledge to help you stay secure in this digital era.
Thanks for joining us on this continuing adventure!
About Triumvirate Cybersecurity
Triumvirate Cybersecurity is a CyberAB Registered Practitioner Organization (RPO) which specializes in cyber compliance for small and mid-size government contractors. Based in Dayton, Ohio, we help organizations make sense of requirements, implement effective security programs, and achieve compliance with confidence so they can get back to what they do best!
Ready to put the 3Rs into practice? Reach out through our Contact page or directly via email to info@triumviratecyber.org.
