Stealth, Signature Management, and the PHP Vulnerability - What Military Aviation Already Knew About Hiding in Plain Sight

In October 2025, the U.S. Cybersecurity and Infrastructure Security Agency, joined by counterparts in the United Kingdom, Australia, Canada, and New Zealand, issued a joint advisory warning of critical vulnerabilities in PHP, a programming language underpinning a substantial portion of the world’s web infrastructure. Active exploitation had already been observed. The patch exists. But the deeper principle behind this advisory is one military aviation has understood for decades: the most effective defense is often invisibility.

What a Five-Nation Advisory Tells You About Severity

When five allied nations coordinate a public cybersecurity warning, the severity is not in question. PHP runs server-side code on content management systems, web-based booking tools, and internal portals at corporations and government agencies worldwide. The specific vulnerability involves remote code execution - an attacker who identifies a server running a vulnerable PHP version can potentially execute their own code on that server without physical access, without credentials, and sometimes without leaving an obvious trace.

If you manage any web-connected aviation infrastructure - a flight school site, an FBO booking system, a club maintenance tracker - this advisory is not background noise. Apply the patch.

The F-117 and the Logic of Not Being Found

On January 17, 1991, eight F-117 Nighthawks crossed into Iraqi airspace without fighter escort and without dedicated jamming aircraft. Baghdad’s integrated air defense system was not unsophisticated: Soviet-supplied surface-to-air missiles, early warning radar, intercept fighters on alert. By conventional analysis, those aircraft should have been detected.

They were not. The Iraqi air defense system never achieved a clean firing solution because it never achieved a clean radar return.

The F-117 did not outshoot the threat. It made itself nearly impossible to find, track, and target. That distinction - between defeating a threat and denying the threat an opportunity - is the core of what the military calls signature management.

Stealth Is Not Just Radar Cross-Section

Radar cross-section is the most commonly cited signature. It is not the only one. Low observable aircraft design addresses four distinct signatures: radar, infrared, radio frequency emissions, and acoustic. Any single signature can give an adversary enough information to complete a targeting sequence.

The intellectual foundation for the F-117 came from a paper published in the late 1960s by Soviet physicist Pyotr Ufimtsev, which described how the geometry of an object determines its radar return. The Soviet Academy of Sciences published it openly. The Soviets did not fully exploit it. Lockheed’s Skunk Works did.

Engineer Denys Overholser read a translated version in the early 1970s and recognized that the mathematics could be used to engineer an aircraft with a dramatically reduced radar cross-section. That work became Have Blue, a classified demonstrator that proved the concept. The F-117 Nighthawk followed, entering service in 1983 and remaining classified until 1988 - flying operational missions in secret for five years.

The aircraft was not fast. It had no air-to-air capability. But it could penetrate defended airspace because ground-based radar returned a signal roughly comparable to a large bird - not zero, just small enough that the system could not reliably distinguish it from noise.

Each Generation Extended the Principle

The B-2 Spirit pushed further. Its flying-wing configuration reduced radar cross-section, and its exhaust system mixed hot gases with ambient air before exit, suppressing infrared signature. The result was a high-altitude platform that could operate over heavily defended territory with dramatically reduced probability of detection by any single sensor type.

The F-22 Raptor added supercruise - sustained supersonic flight without afterburner. Afterburner dramatically increases infrared signature. A platform that achieves supersonic cruise without it is harder to track by heat-seeking systems. Stealth and performance were no longer separate design considerations.

Adversaries adapted. Russia’s S-400 and subsequent systems incorporated longer-wavelength VHF and UHF radar, which responds differently to the shaping techniques optimized against X-band emitters. China has invested in what their defense publications describe as counter-stealth radar networks. The edge did not disappear, but it required continuous investment to maintain.

The Kill Chain and the PHP Connection

In 2011, Lockheed Martin published a paper applying military targeting logic to cybersecurity. Their Cyber Kill Chain model describes an attacker’s operational sequence: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The logic is identical to the military framework: find it, fix its position, track it, target it, engage it, assess the result. Break any single link and the attack fails.

Stealth breaks the first link. So does proper server configuration.

When a web server running PHP receives a request, its default configuration includes version information in the HTTP response headers - essentially announcing what software it is running and the exact version number. An attacker scanning for vulnerable targets can automate that query across thousands of internet addresses per minute. They can identify, in seconds, every publicly accessible server running a PHP version with a known flaw.

The server completed the reconnaissance for them.

The defensive response - stripping version information from response headers - is the cyber equivalent of emissions control (EMCON). The discipline of managing what you emit, because everything you emit is information an adversary can receive, analyze, and act on.

The F-117 did not use its active radar during strike missions precisely because active radar announces presence with electromagnetic radiation. A web server broadcasting its software version in every response is the opposite of that - a radar emitting on full power in contested airspace, in a direction the adversary is already watching.

Why Pilots Should Understand This Architecture

Modern aviation runs on networked systems. Electronic flight bags connect to external data sources - datalink weather, airport information, in some configurations operations centers. Newer certified aircraft have wireless avionics update capability. Some maintenance systems allow remote diagnostic access.

ADS-B, now required on most aircraft operating in U.S. controlled airspace, continuously transmits position, altitude, ground speed, and identification to any receiver in range. Services like FlightAware aggregate this data publicly in real time. That is a deliberate design choice, and for collision avoidance and traffic management it serves critical purposes. In civil aviation, signature management of the military kind is not an option - nor should it be. The tradeoffs favor transparency.

What pilots should understand is the underlying architecture: every system that transmits is a system that can be received.

The FAA has been developing its Aircraft Cybersecurity Plan in coordination with the Department of Homeland Security and industry. The concern is not primarily that individual general aviation pilots are being targeted. The concern is systemic. A maintenance laptop that connects to an aircraft’s avionics bus and also connects to a public WiFi network is a potential bridge between two systems that should remain separated. That kind of unintended pathway is exactly what adversaries look for during reconnaissance.

Defense Is Always Layered

The EA-18G Growler exists because electronic attack remains essential even in a world of stealth aircraft. The most survivable platforms combine low-observable design with electronic attack capability: be hard to find, if found be hard to track, if tracked degrade the adversary’s ability to complete the engagement. No single layer is sufficient.

Cyber defense operates on the same model. Signature management reduces reconnaissance effectiveness. Patch management closes known vulnerabilities before exploitation. Intrusion detection identifies active probing before an attack matures. Incident response limits damage when an attack succeeds anyway.

The Air Force’s Next Generation Air Dominance program and the Navy’s F/A-XX program are both developing platforms where low-observable characteristics are foundational requirements from the first line of the document - not bolted on afterward. The lesson of the B-2 and F-22 is that stealth works best when integral to the design.

The lesson for cybersecurity is identical. Systems built from the ground up with minimal exposure, hardened by default, with attack surface minimized, are fundamentally different from systems built for functionality first and secured afterward. That is a design philosophy, not just a patch cadence.

Ben Rich, who ran Skunk Works after Kelly Johnson and oversaw the F-117 through operational service, said the best way to defeat a threat is to be invisible to it. He was talking about radar. The principle has not changed.

Key Takeaways

• Five nations issued a joint advisory in October 2025 about actively exploited PHP vulnerabilities enabling remote code execution - apply the patch immediately if you manage any web infrastructure connected to aviation operations.
• Stealth is properly understood as signature management, not just radar cross-section - reducing all detectable emissions across radar, infrared, RF, and acoustic domains.
• The Cyber Kill Chain mirrors military targeting logic: break any link in the sequence and the attack fails; suppressing version information in server headers breaks the reconnaissance link before exploitation begins.
• Aviation’s expanding network connectivity - EFBs, wireless avionics updates, remote maintenance access - creates attack surface that must be understood architecturally, not just technically.
• Defense is always layered - signature management, patch management, intrusion detection, and incident response each address different phases of an attack; no single measure is sufficient on its own.