@NextgovFCW cybersecurity + intelligence reporter. Tips: [email protected] Signal: djd.99
Washington, DC
Joined June 2013
- Tweets7.6K
- Following1.4K
- Followers3.2K
- Likes37.8K
Pinned Tweet
Honored to be recognized at The Echo Awards yesterday as the 2026 Best Investigative Journalist, alongside my colleague Ross Wilkers, recognized for his great work covering government contracting.
David DiMolfetta retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/…
David DiMolfetta retweeted
Today, I’m issuing an executive directive to strengthen the Commonwealth’s cybersecurity and address the threats posed by the rapid development of artificial intelligence.
This moment demands leadership, coordination, and a thoughtful path forward to address these serious threats — particularly as we have seen no leadership from this President and his allies in Congress.
This is just the beginning — I’ll continue to leverage my authority as the Governor of Virginia to address potential threats, strengthen our Commonwealth’s security, and prioritize the safety of Virginians.
What a busy week for cyber and intelligence news. Kudos to all the reporters who have been covering and helping everyone make sense of it all. So grateful for all I learn from my peers on this beat.
David DiMolfetta retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
New: The senior CISA official whose office helps oversee a key global system for tracking software vulnerabilities is leaving government service this week after nearly six years at the agency. A major departure as AI changes the vulnerability landscape.
nextgov.com/cybersecurity/20…
David DiMolfetta retweeted
Less than 2 weeks until Election Day, DOJ brings charges against two ex-FBI officials for allegedly lying to Congress as part of a probe that focused on whether FBI investigators sought to minimize allegations of Biden family corruption, colleagues report: cnn.com/2026/10/23/politics/…
David DiMolfetta retweeted
New in @TheAtlantic, my profile of CIA Director John Ratcliffe, one of Trump's closest advisers, and the man in the middle of the president's deeply conflicted Ukraine policy.
theatlantic.com/national-sec…
David DiMolfetta retweeted
lots of media stories on a new pentagon intel entity that will involve non official cover operations. I have no idea about any of this (really), I'm long out of that secret world. I yap on tv and watch the redsox full time now. sorry, cant confirm or deny any of this, not going there. but of course I read the pieces with interest. and what I will say is that due to the current ubiquitous technical surveillance (UTS) environment, which appears to me to be biggest challenge to HUMINT I've ever seen over the last century, this is the right way to approach espionage. official cover out of overseas locations is far less effective. no one can deny that. so whatever the IC is planning to do, in whatever alphabet soup agency, and if it has proper congressional oversight (very big deal), the use of non official cover to defeat our adversaries is absolutely the way to go. that's all I got.
Hackers have made millions of attempts to exploit newly disclosed flaws in PHP as government agencies and businesses around the world work to install emergency fixes, cyber intelligence firms say.
nextgov.com/cybersecurity/20…
David DiMolfetta retweeted
SCOOP: The State Dept has started asking career diplomats up for promotion if they voted for Trump in 16, 20, 24.
Federal law prohibits politically based hiring for career staff.
State tells @washingtonsun it's screening for "fidelity" and execution of the president's vision👇
David DiMolfetta retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
David DiMolfetta retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Russia is targeting Democratic candidates and Ukraine supporters from both parties with disinformation ahead of the midterms, top Intel Committee Dems Mark Warner and Jim Himes said today:
nextgov.com/cybersecurity/20…
On Wednesday, ODNI held a briefing with state and local officials to discuss election threats. The conversation and the offering of services “didn’t always appreciate the reality of being 13 days from the midterm election,” one person who attended the call told us.
Devastating. I have so many memories growing up playing the Mass Effect games and was looking forward to this next one.
BREAKING: Electronic Arts is cutting 400 jobs and shutting down BioWare, the legendary development studio behind Dragon Age and Mass Effect. bloomberg.com/news/articles/…
One U.S. federal agency is scrambling to implement PHP fixes, an official in that agency tells me. They have "quite a few" instances of PHP running on their systems, and they are expecting to implement patches in the coming hours. Our full coverage below:
nextgov.com/cybersecurity/20…
FBI on this PHP matter as well. "Patch and Hunt Immediately"
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.