Concentric is monitoring the U.S. drawdown of diplomatic and military personnel across the Middle East, after a U.S. intelligence memo warned Iranian plots to kill U.S. officials have reached advanced stages. We are also tracking the spread of Ebola beyond the Democratic Republic of Congo (DRC), after Nigeria confirmed its first case and Kenya reported nine, exposing gaps in airport screening. Finally, we are assessing the global rush to patch critical artificial intelligence (AI)-discovered flaws in PHP, the programming language behind most of the world’s websites.
U.S. Pulls Staff From Region as Intelligence Warns of Iranian Plots Against Officials
U.S. Director of National Intelligence Jay Clayton warned Secretary of State Marco Rubio in an October 23 memo Iran has substantially increased efforts to target U.S. diplomats and officials in the Middle East and beyond, and lethal plots have reached “advanced stages.” The memo does not name specific targets or countries. U.S. officials cited the intelligence report for the Department of State’s (DoS) decision to cut staff at several embassies in the region. On October 21, DoS ordered nonessential staff and family members to leave Saudi Arabia, citing the Houthi threat, and later clarified the order does not extend to the rest of the Gulf. Smaller staff reductions are also occurring at other posts, including in the United Arab Emirates, Qatar, Jordan, and Lebanon. The U.S. military has also quietly scaled back its presence at regional bases, mirroring drawdowns before U.S. and Israeli strikes on Iran began in February. U.S. officials fear the Houthis could expand attacks beyond Saudi Arabia to other countries in the region. Iran’s Islamic Revolutionary Guard Corps threatened on October 22 to strike U.S. bases if American forces continue escorting ships through the Strait of Hormuz. White House officials said the U.S. would not strike Iran before the November 3 midterms, while Israeli sources expect joint strikes soon after. Concentric assesses U.S. diplomatic posts, military facilities, and high-profile U.S.-linked businesses face the greatest risk if strikes resume. Reduced embassy staffing will also limit consular support for private citizens if conditions deteriorate. We advise organizations to treat the U.S. drawdown as a trigger to review the presence of U.S. nationals in the Gulf, Jordan, and Lebanon, and to plan departures that do not rely on U.S. government assistance. Senior executives and other high-profile staff should vary their routines, limit publicity of travel plans, and avoid U.S. diplomatic and military sites. Companies should also review security at offices and residences located near these sites.
Ebola Reaches West Africa as Nigeria Confirms First Case
Nigeria confirmed its first Ebola case on October 20, marking the first spread to West Africa of a Bundibugyo strain outbreak that began in the eastern DRC in May. The patient, a woman who flew into Abuja from Uganda on October 3, developed symptoms on October 7 and was admitted to a private hospital on October 11, but was not tested until October 19. Health officials have identified 44 contacts. Kenya has confirmed nine cases since October 6. Its first patient, who later died in Nairobi, traveled from the DRC through Uganda and passed temperature checks at airports in Entebbe and Nairobi. Officials are investigating whether the first Kenyan and Nigerian patients crossed paths at a Ugandan airport; Uganda has since stepped up screening at Entebbe International Airport. The DRC has reported more than 9,700 confirmed cases and 4,680 deaths, with eight provinces affected. The United Nations’ Ebola coordinator has described the outbreak as the most geographically extensive on record. The World Health Organization continues to advise against travel restrictions on affected countries. Concentric assesses further imported cases in East and West African cities are likely in the coming weeks, particularly given delays in detection and gaps in airport screening. Ebola spreads through direct contact with the bodily fluids of symptomatic people, and the risk to travelers who avoid healthcare facilities and contact with sick people remains low. We advise organizations with personnel in or traveling to the DRC, Uganda, Kenya, and Nigeria, to brief staff on symptoms and exposure risks, and to expect enhanced health screening and possible delays at regional airports. Companies should confirm their medical evacuation providers will transport suspected infectious disease cases, and ensure travelers who develop a fever within 21 days of visiting an affected country seek medical care and report their travel history.
AI-Discovered PHP Flaws Trigger Global Patching Rush as Exploitation Attempts Surge
Cybersecurity firm Wiz Research announced on October 21 it used OpenAI technology to find two critical vulnerabilities in PHP, the programming language that runs about 70 percent of the world’s websites. The flaws, dubbed PHP2Shell, went undetected for more than a decade. The PHP Foundation released patches the same day. The FBI warned the flaws allow attackers to run code remotely on web servers, putting sensitive data and networks at risk, and advised operators to take websites offline if they cannot update them immediately. The U.S. National Security Agency and the European Union Agency for Cybersecurity also urged organizations to act immediately. Cloudflare reported millions of attempts to exploit the flaws within hours of the announcement. Government websites in the U.K., Japan, and Finland were partially taken offline while patches were applied, although Japan said it had received no reports of damage. Researchers also used AI to develop working attacks against the flaws, showing how quickly the tools can turn a newly disclosed vulnerability into a usable exploit. Concentric assesses that attackers will continue to target unpatched PHP websites in the coming weeks, including those run by third-party vendors and hosting providers. AI tools are shortening the time between disclosure and exploitation, leaving organizations less time to patch. We advise organizations to confirm whether their websites, customer portals, and internal applications run on PHP, apply the PHP Foundation’s patches immediately, and take unpatched systems offline. Companies should ask web hosting providers and third-party vendors to confirm they have patched, and review server logs for signs of compromise since October 21.
