PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

PHP 2026-10-21

Context & Ripple Effects

PHP had given administrators advance notice of two 9.2-rated flaws in a planned emergency release, but the embargo was disrupted when watchTowr publicly confirmed the vulnerabilities were real. That compressed the preparation window for teams running PHP-facing services.

The exposure is unusually broad: watchTowr said the flaws reach PHP versions dating to PHP 5, while a contemporaneous report about a purported PHP2Shell exploit tool raised the stakes around rapid remediation. Cloudflare said it had deployed initial WAF rules for known exploit vectors, but described them as an interim layer rather than a substitute for upgrades.

First-order effects

Web-serving PHP operators must move to the fixed 8.5.12, 8.4.27, 8.3.36, or 8.2.35 releases and validate their deployments against unauthenticated code-execution risk.
Hosting providers and managed-service teams face an immediate patch-and-notification workload because their customers' public-facing applications share the affected runtime.

Second-order effects

Cloudflare's initial rules give customers a compensating control for known attack paths, increasing pressure on other edge and security providers to publish similarly actionable mitigations while customers schedule upgrades.
Security teams must prioritize PHP patching ahead of lower-severity maintenance work, particularly where public applications cannot be quickly taken offline for testing.

Third-order effects

The episode reinforces that a critical flaw in a common web runtime turns routine version management into coordinated infrastructure response across application owners, hosts, and edge-security providers.
If embargo leaks recur around ecosystem-wide flaws, vendors and defenders will have less time to stage patches before public reporting shifts attention toward exploitability.

The trend: Critical web-runtime vulnerabilities are making patch readiness and layered edge mitigations core operational requirements for organizations running public applications.

Discussion

@watchtowrcyber @watchtowrcyber on x
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.
@thephpf @thephpf on x
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
@dok2001 Dane Knecht on x
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
@k_firsov Kirill Firsov on x
php2shell Tomorrow is a helluva day.
@marckohlbrugge Marc Köhlbrugge on x
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
@alvosec @alvosec on x
⚠️ RCE in PHP is in the wild, it's going to be ugly. Quick fix: session.upload_progress.enabled = Off https://www.php.net/...
@j4ck3lsyn @j4ck3lsyn on x
I have successfully recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619 > Two heap use-after-free primitives in PHP's ‘session.upload_progress’ handler ('php_session_rfc1867_callback', ext/session/session.c)... #CyberSecurity #infosec #php #C4b1NKr3W #php2shell
@astuyve AJ Stuyvenberg on x
Another (hour) another RCE, this time in PHP CVSS 10 btw
@mattjay Matt Johansen on x
PHP and SSL CA's being broken in the same week... It's like finding out all cement would fail this week without remediation.
@r0ckstardev @r0ckstardev on x
If you're running a PHP website - a critical vulnerability was disclosed before the announced updates tomorrow. If you can't shut down your website and wait for the PHP update, feed your AI this prompt: URGENT: critical PHP security release on 2026-10-21 at 14:00 UTC. Background …
@kostastsale Kostas on x
A moron has released a POC early for php2shell so here is what you need to do: If you're on version prior to 8.2: Edit php.ini: session.upload_progress.enabled = Off Then reload php-fpm and restart apache If you're on later version: Update (it'll be available in a few hours) In a…
@rina4_tot Daniele Berardinelli on x
More details about CVE-2026-109618 and CVE-2026-109619, the PHP RCE. Upload progress can serialize before basic RINT clears BG(serialize) There is currently no possible mitigation. See the screenshot below to understand how I got the UAF 😼
@hawolt @hawolt on x
tomorrow will be a fun day on the internet [embedded post]
@ncsc @ncsc on x
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ https://www.ncsc.gov.uk/...
@codewithtamara Tamara Martinović on x
Sad day for WordPress. If you run a WordPress site, check with your host about the PHP security update.
@mattjay Matt Johansen on x
This is gonna be a bloodbath if Andrew is warning people to go ahead and take any PHP offline until patch drops.
@obsproject @obsproject on x
Parts of our website will be unavailable while we await disclosure of a PHP vulnerability. This should not impact streaming via connected accounts.
@watchtowrcyber @watchtowrcyber on x
Small update: we've now pushed network-level mitigation capabilities to watchTowr Platform clients (via Active Defense), ahead of PHP providing patches. https://watchtowr.com/ for more information. [embedded post]
@heyandras Andras Bacsai on x
Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation. (generated and validated by LLM) 1️⃣ Do this first. In php.ini or the FPM pool, set: session.upload_progress.enabled = 0 Reload PHP-FPM, then update PHP right a…
@44latte @44latte on x
You COULDNT HAVE FUCKING WAITED 14 Hours. i hope your forever blacklisted from cybersec/related industries for dropping a unpatched critical 1day on twitter you fucking idiot
@jeftovic Mark E. Jeftovic on x
If you're in dev/ops - hug your family and get a good nights sleep. Tomorrow is gonna suck. [embedded post]
@arvidkahl Arvid Kahl on x
Every PHP dev who booked a flight (or a meeting) for 10:00am tomorrow: 😰😰😰
@taylorotwell Taylor Otwell on x
Critical PHP vulnerabilities to be disclosed tomorrow: https://www.php.net/.... We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP. You may need to redeploy your apps at that time to use these p…
@marcelpociot Marcel Pociot on x
🚨 If you use PHP, get ready to update your PHP version (8.0+) tomorrow at 14:00 UTC for a critical PHP security release! https://www.php.net/...
@magicaltux Mark Karpelès on x
Multiple people have been posting on X on their confirming the discovery of the exploits and posting varying amounts of details. I would consider this in the wild now. https://x.com/...
@wescopeland_ Wes on x
PSA: set session.upload_progress.enabled = 0 and go back to bed
@magicaltux Mark Karpelès on x
So yea about that new RCE in PHP, if it took me ~10min to find, you know it's already into some bad hands.
@lowleveltweets @lowleveltweets on x
hey man. if you run php. turn it off.
@mattiasgeniar @mattiasgeniar on x
RIP all WordPresses running on PHP 7.x versions? 😬 https://www.php.net/...
@iinovacore @iinovacore on x
again [image] [embedded post]
@udiwertheimer Udi Wertheimer on x
crypto intellectuals sow panic about how all public key cryptography might be broken one day meanwhile the entire internet gets pwned by vulnerabilities in php [embedded post]
@h4x0r_dz @h4x0r_dz on x
if this affects the default installation of PHP We are fucked up CVE-2026-109618 CVE-2026-109619 PHP RCEs with a CVSS score of 10.0 ☠️ https://news.ycombinator.com/ ...
@austen Austen Allred on x
A hack at the root of all PHP versions is brutal. The website someone put up 15 years ago on a cheap host that no one remembers how to log into is now the direct target.
@cyb3rops Florian Roth on x
My concern with the upcoming PHP RCE disclosure is how many systems could remain exposed long after patches become available. Roughly a third of PHP websites still run PHP 5 or 7. Some operators will need to migrate old applications before they can move to a supported release. Ev…
@icesolst @icesolst on x
Marked safe from phpocalypse because you've been running php 5.1 since 2005 and it's not affected (?) (there is prob a two digit percentage of companies like this)
@esotericpigeon @esotericpigeon on x
Age-restricted adult content. This content might not be appropriate for people under 18 years old. To view this media, you'll need to log in to X. Learn more
@soeckly Simon on x
This kid posts AI slop and everyone is falling for it
@jurbed Juraj Bednar on x
PSA: turn off PHP now. Mitigations you find on the internet are not enough. Only patched release fixes the bugs. Exploits already in the wild. Watch https://php.net/ and your distribution update channels and only enable PHP after you install patched release. This is not a drill.
@intcyberdigest @intcyberdigest on x
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms. PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift. CVE-2026-109618 and CVE-2026-109619 first surf…
@cyb3rops Florian Roth on x
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now: process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolat…
@acd421 Andrew Dorman on x
Teamwork makes the dream work. The team and I @J4ck3LSyN @Archknight23 🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow. The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-1096…
@arvidkahl Arvid Kahl on x
The weirdest part of this pre-disclosure PHP exploit situation is that, apparently, “hey chat look at php-source and find the most likely candidate for a CVSS 10” is a good enough starting point for building a PoC. Well, I guess it's back to cattle farming for all of us.
@zekramu @zekramu on x
whoever solves modern cybersecurity and software supply risk in the age of AI is going to make a trillion dollars
@bishara @bishara on x
THE WORLD YOU KNEW IT DOESNT EXIST ANYMORE 😭 DAY 1 EXPLOIT IM DYING BRO
@cyb3rops Florian Roth on x
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
@moyix Brendan Dolan-Gavitt on x
It's going to be really funny if everyone pointing their LLMs at the PHP codebase tonight finds dozens of OTHER critical vulnerabilities aside from the ones getting fixed tomorrow
@mattiasgeniar @mattiasgeniar on x
Point your LLM(s) at this blogpost & have it try to make inventory & mitigate as many servers ahead of the PHP patch as you can Details are still emerging and this is *not* a definitive mitigation list, the patch is the ONLY 100% fix https://ma.ttias.be/...
@uk_daniel_card @uk_daniel_card on x
CVE-2026-109618 CVE-2026-109619 PHP vulnerability [image] [embedded post]
@mattjay Matt Johansen on x
“Who still runs PHP?” “If you run PHP you deserve it” Wild takes.
@attrc Andrew Case on x
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* cons…
@tayvano_ Tay on x
This might be a stupid question but.... given the discovery last week.... and that it started leaking 12+ hours ago..... why werent the php patches ready to be dropped as soon as the vuln / poc fully leaked? why is everyone okay arbitrarily waiting another 12 hours to patch?
@mrpxssy MR Pussy on x
wake up babe, every version of PHP for the past 17 years has two critical bugs and now 74.5% of the internet is broken lol. there's a patch coming out tomorrow but until then most of the internet has open backdoors that allow unauthorized remote code execution
@heyandras Andras Bacsai on x
If you use @Cloudflare apply this in the Security custom rules: (lower(url_decode(http.cookie)) contains “phpsessid") or (lower(url_decode(http.request.uri.quer y)) contains “phpsessid") or (any(lower(http.request.headers["conten t- type"][*]) contains “multipart/form-data")) It …
@ryanzohoury Ryan Zohoury on x
Woah this is so cool. I sloppily asked ChatGPT “how many websites use php?” Using the number keypad on my iPhone and it was able to figure out what I was asking.
@pinboard @pinboard on x
There's a severe bug in PHP that is apparently being exploited already. To protect everyone's data, I have taken Pinboard offline until patches are released tomorrow. I'll get the site back up as soon as I can after that happens.
@openhack @openhack on x
🚨 PHP is going to be dropping emergency security updates tomorrow (October 21st, 14:00 UTC). - CVE-2026-109618 & CVE-2026-109619 are unauthenticated RCE vulnerabilities both with a score of CVSS 9.2 - The RCE appears to work on default installations of many services & frameworks …
@lowleveltweets @lowleveltweets on x
WARNING [embedded post]
@grapheneos.org @grapheneos.org on bluesky
Our discussion forum is the only software we have using PHP. We've taken it down temporarily while waiting for the patches for www.php.net/archive/2026... due to vulnerability details already being available and proof of concept exploits being developed. Don't want to take the …
@serghei Sergiu Gatlan on bluesky
Patches drop at 10 AM EST or earlier, “should evidence of active exploitation appear in the wild.” — No technical details yet, and no info on affected or fixed versions. — www.bleepingcomputer.com/news/ securit...
@tolkienguide.com @tolkienguide.com on bluesky
TolkienGuide.com is proactively disabled, waiting for php security vulnerability patches to be released, tested and deployed. Sorry for the inconvenience. — www.php.net/archive/2026...
r/hacking r on reddit
PHP warns admins of two critical flaws, emergency patches coming tomorrow
r/NextCloud r on reddit
When I remember that nextcloud runs on PHP too
r/programming r on reddit
Critical Vulnerabilities in PHP
@nsacyber @nsacyber on x
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or databas…
@kiwifarmsdotnet @kiwifarmsdotnet on x
We're back! Remember to update PHP if you run a website on it!
@geerlingguy Jeff Geerling on x
This might be the most watched GitHub Actions build in the history of the platform: https://github.com/...
@ncsc @ncsc on x
The NCSC has issued an update to the PHP alert reflecting the release of mitigations. We encourage UK organisations to take immediate action. For more information on the issue as well as our guidance, head to⬇️ https://www.ncsc.gov.uk/...
@dok2001 Dane Knecht on x
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New ru…
@jonoberheide Jon Oberheide on x
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
@wordpress @wordpress on x
The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider's update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updat…
@burcs Brandon on x
it's kind of wild to work at a company that can basically flip a switch and protect 20% of the internet from critical vulns [embedded post]
@unit42_intel @unit42_intel on x
CVE-2026-109618 and CVE-2026-109619 are two Critical RCE vulnerabilities in PHP with CVSS scores of 9.2. We advise organizations to assess web servers and patch immediately. Read our latest Threat Brief for mitigations: https://unit42.paloaltonetworks.com/ ...
@braydenwilmoth Brayden on x
One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. https://dash.cloudflare.com/ ... This reduces your risk but doesn't fix the vulnerabilities i…
@geerlingguy Jeff Geerling on x
PHP Security Advisories are out: RCE via OOM corruption (9.2/10): https://github.com/... RCE via stale global state (9.2/10): https://github.com/... Need to upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 ASAP to mitigate. Updates rolling out now. #PHP
@laravel @laravel on x
We have temporarily halted Laravel Cloud deployments while we work on automated deployment of patched PHP instances. PHP 8.2+ Vapor images are being built and automated deployment will begin shortly. Envoyer has been temporarily taken offline to receive patching. We will continue…
@isaoshimizu Isao Shimizu on x
“PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.” https://www.php.net/...
@astuyve AJ Stuyvenberg on x
Patches are live everyone. good luck and godspeed https://www.php.net/... [embedded post]
@sherrod_im @sherrod_im on x
This is critical. Please follow guidance from PHP and us at Unit 42 Palo Alto Networks. Defenders, time to defend. https://unit42.paloaltonetworks.com/ ...
@_johnhammond John Hammond on x
phucking patch https://www.php.net/... https://github.com/... https://github.com/... [image]
@dok2001 Dane Knecht on x
PHP changes are live. Start patching. https://www.php.net/... Huge thanks to coordinated work by @ThePHPF! [embedded post]
@tridevgurung Tridev Gurung on x
we've temporarily taken buymemomo offline as a precaution, which is why you'll be seeing this screenshot. …
@uwu_underground @uwu_underground on x
Step 1. Fuzz your CloudFlare servers to figure out what gets filtered at the WAF level Step 2. reverse engineer a vulnerability Step 3. Profit [embedded post]
@intcyberdigest @intcyberdigest on x
The day the internet broke, and most of it is too old to fix.
@arvidkahl Arvid Kahl on x
Another reminder of why our $5/month is extremely well spent. [embedded post]
@cstanley Christopher Stanley on x
Thanks Dane, Cloudflare has always been a huge shield for the public. Appreciate you all so much. [image] [embedded post]
@blackroomsec @blackroomsec on x
Reposting this from my own comment so you all see it. Re: PHP patch today. …
@laravel @laravel on x
At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No …
@ericjgeller.com Eric Geller on bluesky
🚨 The developers of PHP have just released new versions that patch two critical vulnerabilities that could allow remote code execution on any website running PHP (which is virtually all of them). www.php.net/archive/2026... [image]
@dok2001 Dane Knecht on x
Credit to @OpenAI @wiz_io @ThePHPF for finding php2shell and running a responsible, coordinated disclosure. This won't be the last one. Models will keep finding bugs like this in software everyone runs. Maintainers, researchers, providers and governments need a new shared playboo…
@emollick Ethan Mollick on x
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
@davewiner Dave Winer on x
PHP is an important foundation of the early web, and it must be preserved.
@andrewcurran_ Andrew Curran on x
OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.
@steipete Peter Steinberger on x
That PHP vulnerability that's gonna cause havoc this week was found with... GPT-5.6 Sol.
@derrickcchoi Derrick Choi on x
Our models found critical vulnerabilities in PHP
@itszn13 @itszn13 on x
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.  Please read more about our approach:
@openai @openai on x
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, a…
@ericjgeller.com Eric Geller on bluesky
OpenAI, whose model helped researchers discover the vulnerabilities: “Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory.” openai.com/index/coordi...
@calif_io @calif_io on x
Let's set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://x.com/... His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, …
@lcfr_hax @lcfr_hax on x
LCFR (@lcfr_hax) on X
@calif_io @calif_io on x
php2shell - A tale of two PHP remote vulnerabilities: https://calif.io/...
@google @google on x
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
@cloudflare @cloudflare on x
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
@kennwhite Kenn White on bluesky
“Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.” — www.wiz.io/blog/php2she...
@ericjgeller.com Eric Geller on bluesky
Wiz: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” www.wiz.io/blog/php2she...
@mattburgess1 Matt Burgess on bluesky
Of course, the PHP vulnerabilities were allegedly discovered by AI — “In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade” — www.wiz.io/blog/php2she...
@jcoglan.com @jcoglan.com on bluesky
you very urgently need to turn off every single running php process right now, no exceptions www.wiz.io/blog/php2she...
@jonty Jonty Wareing on bluesky
Oh damn it's as bad as expected: If you are running anything on PHP turn it the hell off RIGHT NOW until you can patch it. — Yes this means every single Wordpress, Drupal, and Wikimedia install. — www.wiz.io/blog/php2she...
@sagitz_ @sagitz_ on x
The impact is massive. PHP powers about 70% of the web. The number of vulnerable instances is astronomical. Any PHP website for the last 10 years is vulnerable to this. Patch now!
@sagitz_ @sagitz_ on x
As expected in 2026, AI did most of the work here. This research began with a prompt targeting security flaws in PHP functions reachable from popular codebases. One thing led to another, and we ended up uncovering an entire class of security vulnerabilities in PHP itself🤯
@sagitz_ @sagitz_ on x
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are memory corruption issues in PHP's internal error handling (out-of-memory, fatal errors). We've demonstrated that these can be exploited to full RCE or Heartbleed-style memory disclosure, regardless of application logic
@sagitz_ @sagitz_ on x
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
Alon Noy Alon Noy on linkedin
🚨 𝗔 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗵𝗲𝗮𝗱𝘀-𝘂 …
Deanna Murphy Deanna Murphy on linkedin
Heads up for anyone managing a website. — A potentially critical security vulnerability in PHP, the software powering a significant portion of the internet …
Camran K. Camran K. on linkedin
Urgent: Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. …
r/CroIT r on reddit
Upcoming Critical PHP Security Release
r/Hostinger r on reddit
Upcoming Critical PHP Security Release
@gdb @gdb on x
Towards securing the internet
r/accelerate r on reddit
“OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP …
@rhyssullivan Rhys on x
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
r/technology r on reddit
AI Just Found a Bug That Puts Up to 70% of the World's Websites at Risk
r/worldnews r on reddit
Government websites go dark as software flaw sparks security scramble
@thephpf @thephpf on x
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security https://thephp.foundation/…
r/PHP r on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security
@paulosyibelo Paulos Yibelo on x
there's a real risk that a single PHP server will be exploited to infiltrate a guest OS somewhere, & from there, CVE-2026-99999 could be exploited to breach the host OS, leading to all other guest servers. So even if you don't run php, if some random customer of your host does,
@mattinformed Matt Johnston on x
Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln). There is exploit code available for this vuln, though it is not known to exist …
@anilistco @anilistco on x
In light of the incoming major PHP security vulnerability (https://x.com/...), we will be taking the site and API down until we can confirm a fix on our side. Apologies for the short notice. There is no ETA to when we will be back up, though hopefully within the day. [embedded po…
r/cybersecurity r on reddit
PHP: Critical remote code execution vulnerabilities, update now
r/UgreenNASync r on reddit
DISABLE NEXTCLOUD ON YOUR NAS
@openai @openai on x
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/...
@peterwildeford Peter Wildeford on x
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! …
@nicbstme Nicolas Bustamante on x
People don't realize this critical PHP vulnerability was found using GPT-5.6 Sol. We've already moved on to GPT-6 Astra and GPT-6.1. This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover, or the cyb…
@eric_wallace_ Eric Wallace on x
Similar to our results on math, we have been using internal frontier models to find …
r/technology r on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
r/singularity r on reddit
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
@eastdakota Matthew Prince on x
We had to invent a new form of WAF to mitigate this latest set of vulnerabilities. Now enabled by default for all customers for free.
Antoine Brossault Antoine Brossault on linkedin
Next time you are on the market for a new WAF, keep this in mind: Cloudflare protected its clients 9 hours before the public disclosure of php2shell. …
r/CloudFlare r on reddit
Cloudflare deploys protections against php2shell vulnerability
@fbicyberdiv @fbicyberdiv on x
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially…
@kayin.moe @kayin.moe on bluesky
If you're someone stuck on some old PHP or some shit, php.net listed even more mitigation techniques than the ones that were going around. These aren't perfect, but w/e. Maybe some time today, sometime in a few days, people will probably have resources for backporting these fix…
@so8res Nate Soares on x
It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the “defense will run ahead of offense
@masnick.com Mike Masnick on bluesky
Kind of fascinating that both Google and OpenAI are claiming credit for their AI tools discovering (apparently independently) the massive, scary PHP vulnerability that is taking down sites across the internet today. — cloud.google.com/blog/product... openai.com/index/coordi...
@lookitup.baby Ian Coldwater on bluesky
Oh for actual f's sake. If you're going to drop catastrophic 0days that leak before anyone is able to patch them at least have the decency not to brag about giving defenders time to prepare [image]
r/worldnews r on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
r/neoliberal r on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
@lookitup.baby Ian Coldwater on bluesky
The leak wasn't OpenAI's fault. Chainguard unilaterally broke the embargo by releasing built images with fixes before the vulnerabilities were disclosed, forcing maintainers to scramble to release the patches early. — This industry is small and you just can't treat people like…
@sporadica @sporadica on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
@mattburgess1 Matt Burgess on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
r/hacking r on reddit
php patch is available now
r/technology r on reddit
Exclusive | AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk
r/cybersecurity r on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
@sporadica @sporadica on x
wait what in the hell did i miss isn't PHP used legit everywhere is the Internet f*cked? [embedded post]
@davidvorick David Vorick on x
The NSA is telling American companies to take production systems offline. The AI-era of cybersecurity has fully arrived. [embedded post]
@curtis_yarvin Curtis Yarvin on x
Disclosure of vulnerabilities is no longer the right model. It's a blacklist model. It assumes default security. The right model is a whitelist model. All code with potential security risks has to come with an AI redteaming certificate. Anything that's not like an XML file [embed…
@rseroter Richard Seroter on x
“Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.” https://cloud.google.com/... [embedded post]
@jamesomalley.co.uk James O'Malley on bluesky
Jesus. OpenAI says ChatGPT found a major security flaw in PHP, which runs a significant part of the web. — (And it found it using GPT 5.6, so not even the latest model.) — openai.com/index/coordi...
@jeremiahdillon Jeremiah Dillon on x
This fall we heard a lot of discussion of p(doom). I think more of us should instead be focused on p(gloom). Not “everybody dies”, but instead “everything sucks
@marypcbuk Mary Branscombe on bluesky
PHP Foundation kind of found the first vuln in 2024 but “the PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice” — don't dunk on a bunch of volunteers for that; dunk on everyone depending on but…
@avandeursen@mastodon.acm.org Arie van Deursen on mastodon
Must-read blog post from the PHP foundation: — > [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618. — > the lack of a known path to remote code execution and the small team of core…
@s_panteleev Sergey Panteleev on x
🎉 #PHP 8.6.0 Alpha 1 is available for testing! In this very initial preview for PHP 8.6, we have: - New polling API - New clamp() function ... and more! ➕ Do: Test your projects! ➖ Don't: Run it in production. It's not fully ready yet. 🔗 https://www.php.net/...
@firt Maximiliano Firtman on x
🔥 PHP SECURITY FIXES RELEASED This is mandatory for every PHP service out there. If you can't update it right now, there are some rules you can apply in the meantime. Older versions of PHP, not receiving security fixes anymore, are also affected. https://www.php.net/... [image]
@novacrystallis.com Nova Crystallis on bluesky
Per The Lodestone, FFXIV is restricting logins due to a critical PHP vulnerability. Square Enix is “currently working to enhance security & are assessing the time required for restoration.” — Alert from PHP.net: “Critical remote code execution vulnerabilities, update now” — …
r/GeminiAI r on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
NewsMax.com Jim Mishler on x
FBI Warns of Critical Flaws Affecting PHP Websites
@burcs Brandon on x
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
@alphaque Dinesh Nair on x
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…
r/cybersecurity r on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
r/programiranje r on reddit
OpenAI našao kritičan vulnerability u PHPu, 70% interneta pogodjeno
Hemant Baidwan Hemant Baidwan on linkedin
The critical PHP vulnerabilities CISA flagged today are a good reminder that security tools are only as effective as how they are implemented, configured, and queried. …
@bobmcmillan Robert McMillan on x
Have been following the PHP2Shell issue for the past few weeks. Here's the backstory of how it was found and why it matters. https://www.wsj.com/...
@dwlz Dan Loewenherz on x
Human researcher flagged PHP2Shell as problem area more than a decade ago, but no one did anything about it. Now Wiz's cofounder says it couldn't have been found without AI. How can both of these things be true? https://www.wsj.com/... [image]
@jenstilmanydots JennyManyDots on x
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities. The Dutch cybersecurity agency itself went offline. https://www.reuters.com/... [image]
r/technology r on reddit
The AI-Hacking Apocalypse Began Last Night

Chronicles