PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

PHP 2026-10-22

Context & Ripple Effects

PHP’s development team gave advance notice on October 20 of two 9.2-rated flaws, while researchers identified them as RCE issues. The Foundation says circulating CVE IDs forced an earlier-than-planned patch release, compressing the time between disclosure and remediation.

The fixes cover PHP 8.2 and newer; the Foundation has said legacy deployments depend on third-party vendors for updates. Public advisories from CISA and other security bodies, alongside WordPress’s call for site owners to verify hosting-provider plans, make patch availability only the first step in reducing exposure.

First-order effects

Teams running web-serving PHP must move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to remove two confirmed unauthenticated RCE paths.
Organizations on PHP releases older than 8.2 must obtain a vendor-supplied fix or isolate exposed services, because the PHP project’s releases do not cover those versions.

Second-order effects

Hosting providers become a critical remediation bottleneck for PHP-backed sites: WordPress site owners and other customers need confirmation that their provider has deployed the patched runtime.
The CVE IDs circulating before release give attackers a clear target while operators schedule maintenance, increasing the value of asset inventories that distinguish web-serving PHP from non-exposed installations.

Third-order effects

The gap between supported PHP branches and legacy deployments turns a single upstream RCE disclosure into a supply-chain patching problem spread across hosting vendors and enterprise software maintainers.
If pre-release identifiers continue to circulate, coordinated vulnerability disclosure will increasingly favor shorter embargoes and release processes designed for immediate operator action.

The trend: Critical open-source infrastructure vulnerabilities are making remediation speed depend as much on downstream runtime providers as on the upstream project’s patch.

Discussion

@nsacyber @nsacyber on x
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or datab…
@thephpf @thephpf on x
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
@fbicyberdiv @fbicyberdiv on x
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentiall…
@wordpress @wordpress on x
The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider's update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updat…
@eastdakota Matthew Prince on x
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
@calif_io @calif_io on x
Let's set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://x.com/... His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, …
@j4ck3lsyn @j4ck3lsyn on x
I have successfully recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619 > Two heap use-after-free primitives in PHP's ‘session.upload_progress’ handler ('php_session_rfc1867_callback', ext/session/session.c)... #CyberSecurity #infosec #php #C4b1NKr3W #php2shell
@dok2001 Dane Knecht on x
PHP changes are live. Start patching. https://www.php.net/... Huge thanks to coordinated work by @ThePHPF! [embedded post]
@k_firsov Kirill Firsov on x
php2shell Tomorrow is a helluva day.
@obsproject @obsproject on x
Parts of our website will be unavailable while we await disclosure of a PHP vulnerability. This should not impact streaming via connected accounts.
@cyb3rops Florian Roth on x
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now: process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolat…
@s_panteleev Sergey Panteleev on x
🎉 #PHP 8.6.0 Alpha 1 is available for testing! In this very initial preview for PHP 8.6, we have: - New polling API - New clamp() function ... and more! ➕ Do: Test your projects! ➖ Don't: Run it in production. It's not fully ready yet. 🔗 https://www.php.net/...
@braydenwilmoth Brayden on x
One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. https://dash.cloudflare.com/ ... This reduces your risk but doesn't fix the vulnerabilities i…
@astuyve AJ Stuyvenberg on x
Patches are live everyone. good luck and godspeed https://www.php.net/... [embedded post]
@_johnhammond John Hammond on x
phucking patch https://www.php.net/... https://github.com/... https://github.com/... [image]
@isaoshimizu Isao Shimizu on x
“PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.” https://www.php.net/...
@ncsc @ncsc on x
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ https://www.ncsc.gov.uk/...
@paulosyibelo Paulos Yibelo on x
there's a real risk that a single PHP server will be exploited to infiltrate a guest OS somewhere, & from there, CVE-2026-99999 could be exploited to breach the host OS, leading to all other guest servers. So even if you don't run php, if some random customer of your host does,
@anilistco @anilistco on x
In light of the incoming major PHP security vulnerability (https://x.com/...), we will be taking the site and API down until we can confirm a fix on our side. Apologies for the short notice. There is no ETA to when we will be back up, though hopefully within the day. [embedded po…
@sagitz_ @sagitz_ on x
The impact is massive. PHP powers about 70% of the web. The number of vulnerable instances is astronomical. Any PHP website for the last 10 years is vulnerable to this. Patch now!
@arvidkahl Arvid Kahl on x
Another reminder of why our $5/month is extremely well spent. [embedded post]
@sherrod_im @sherrod_im on x
This is critical. Please follow guidance from PHP and us at Unit 42 Palo Alto Networks. Defenders, time to defend. https://unit42.paloaltonetworks.com/ ...
@cstanley Christopher Stanley on x
Thanks Dane, Cloudflare has always been a huge shield for the public. Appreciate you all so much. [image] [embedded post]
@geerlingguy Jeff Geerling on x
This might be the most watched GitHub Actions build in the history of the platform: https://github.com/...
@kiwifarmsdotnet @kiwifarmsdotnet on x
We're back! Remember to update PHP if you run a website on it!
@dowdedward Edward Dowd on x
NSA issues cyber security alert. Midterms 13 days out. [image] [embedded post]
@sporadica @sporadica on x
wait what in the hell did i miss isn't PHP used legit everywhere is the Internet f*cked? [embedded post]
@cyber_razz Abdulkadir on x
The NSA just told the entire internet to patch or go dark. Effective immediately. …
@jonoberheide Jon Oberheide on x
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
@sagitz_ @sagitz_ on x
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
@geerlingguy Jeff Geerling on x
PHP Security Advisories are out: RCE via OOM corruption (9.2/10): https://github.com/... RCE via stale global state (9.2/10): https://github.com/... Need to upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 ASAP to mitigate. Updates rolling out now. #PHP
@nsacyber @nsacyber on x
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: https://www.nsa.gov/... [embedded post]
@intcyberdigest @intcyberdigest on x
The day the internet broke, and most of it is too old to fix.
@firt Maximiliano Firtman on x
🔥 PHP SECURITY FIXES RELEASED This is mandatory for every PHP service out there. If you can't update it right now, there are some rules you can apply in the meantime. Older versions of PHP, not receiving security fixes anymore, are also affected. https://www.php.net/... [image]
@blackroomsec @blackroomsec on x
Reposting this from my own comment so you all see it. Re: PHP patch today. …
@laravel @laravel on x
At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No …
@marckohlbrugge Marc Köhlbrugge on x
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
@ncsc @ncsc on x
The NCSC has issued an update to the PHP alert reflecting the release of mitigations. We encourage UK organisations to take immediate action. For more information on the issue as well as our guidance, head to⬇️ https://www.ncsc.gov.uk/...
@unit42_intel @unit42_intel on x
CVE-2026-109618 and CVE-2026-109619 are two Critical RCE vulnerabilities in PHP with CVSS scores of 9.2. We advise organizations to assess web servers and patch immediately. Read our latest Threat Brief for mitigations: https://unit42.paloaltonetworks.com/ ...
@davidvorick David Vorick on x
The NSA is telling American companies to take production systems offline. The AI-era of cybersecurity has fully arrived. [embedded post]
@dok2001 Dane Knecht on x
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New ru…
@laravel @laravel on x
We have temporarily halted Laravel Cloud deployments while we work on automated deployment of patched PHP instances. PHP 8.2+ Vapor images are being built and automated deployment will begin shortly. Envoyer has been temporarily taken offline to receive patching. We will continue…
@uwu_underground @uwu_underground on x
Step 1. Fuzz your CloudFlare servers to figure out what gets filtered at the WAF level Step 2. reverse engineer a vulnerability Step 3. Profit [embedded post]
@mattinformed Matt Johnston on x
Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln). There is exploit code available for this vuln, though it is not known to exist …
@tridevgurung Tridev Gurung on x
we've temporarily taken buymemomo offline as a precaution, which is why you'll be seeing this screenshot. …
Hemant Baidwan Hemant Baidwan on linkedin
The critical PHP vulnerabilities CISA flagged today are a good reminder that security tools are only as effective as how they are implemented, configured, and queried. …
@novacrystallis.com Nova Crystallis on bluesky
Per The Lodestone, FFXIV is restricting logins due to a critical PHP vulnerability. Square Enix is “currently working to enhance security & are assessing the time required for restoration.” — Alert from PHP.net: “Critical remote code execution vulnerabilities, update now” — …
@dok2001 Dane Knecht on x
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
@eastdakota Matthew Prince on x
We had to invent a new form of WAF to mitigate this latest set of vulnerabilities. Now enabled by default for all customers for free.
@rhyssullivan Rhys on x
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
@burcs Brandon on x
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
@alphaque Dinesh Nair on x
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…
@mitsuhiko Armin Ronacher on x
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. https://x.com/... [embedded post]
watchTowr watchTowr on linkedin
🚨 Yesterday, information leaked about two Remote Code Execution vulnerabilities in PHP, now known as “PHP2Shell” (CVE-2026-109618 …
r/cybersecurity r on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
r/GeminiAI r on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
@bobmcmillan Robert McMillan on x
Have been following the PHP2Shell issue for the past few weeks. Here's the backstory of how it was found and why it matters. https://www.wsj.com/...
@dwlz Dan Loewenherz on x
Human researcher flagged PHP2Shell as problem area more than a decade ago, but no one did anything about it. Now Wiz's cofounder says it couldn't have been found without AI. How can both of these things be true? https://www.wsj.com/... [image]
@lcfr_hax @lcfr_hax on x
LCFR (@lcfr_hax) on X
@calif_io @calif_io on x
php2shell - A tale of two PHP remote vulnerabilities: https://calif.io/...
@jenstilmanydots JennyManyDots on x
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities. The Dutch cybersecurity agency itself went offline. https://www.reuters.com/... [image]
@jeremiahdillon Jeremiah Dillon on x
This fall we heard a lot of discussion of p(doom). I think more of us should instead be focused on p(gloom). Not “everybody dies”, but instead “everything sucks
r/neoliberal r on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
r/worldnews r on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
@lookitup.baby Ian Coldwater on bluesky
The leak wasn't OpenAI's fault. Chainguard unilaterally broke the embargo by releasing built images with fixes before the vulnerabilities were disclosed, forcing maintainers to scramble to release the patches early. — This industry is small and you just can't treat people like…
@marypcbuk Mary Branscombe on bluesky
PHP Foundation kind of found the first vuln in 2024 but “the PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice” — don't dunk on a bunch of volunteers for that; dunk on everyone depending on but…
r/cybersecurity r on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
@brbarrett Brian Barrett on bluesky
At least one hacker found—and used—the PHP vulnerabilities before they were disclosed. And of course now everybody's getting in on it. from @lhn.bsky.social
@couts Andrew Couts on bluesky
NEW: AWS detected attempts to exploit the PHP vulnerabilities on October 17, four days before they were patched. Logs indicate multiple malicious actors tried to use the flaws. @lhn.bsky.social reports: www.wired.com/story/hacker...
@sporadica @sporadica on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
@charles.littlegreenfootballs.com Charles Johnson on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
@openai @openai on x
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, a…
@gdb @gdb on x
Towards securing the internet
@openai @openai on x
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/...
@rseroter Richard Seroter on x
“Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.” https://cloud.google.com/... [embedded post]
@eric_wallace_ Eric Wallace on x
Similar to our results on math, we have been using internal frontier models to find …
@itszn13 @itszn13 on x
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.  Please read more about our approach:
@emollick Ethan Mollick on x
Companies I talk to are struggling with the rate of patches they need to do thanks to AI defenses finding issues before the inevitable wave of incoming cyberattacks by other AIs. Now consumers are going to have the same experience of getting everything updated often & fast.
@ashleyrgold Ashley Gold on x
OAI says they collaborated with the Trump admin's Super Intelligence Force on this [embedded post]
@andrewcurran_ Andrew Curran on x
OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.
@peterwildeford Peter Wildeford on x
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! …
@dok2001 Dane Knecht on x
Credit to @OpenAI @wiz_io @ThePHPF for finding php2shell and running a responsible, coordinated disclosure. This won't be the last one. Models will keep finding bugs like this in software everyone runs. Maintainers, researchers, providers and governments need a new shared playboo…
@derrickcchoi Derrick Choi on x
Our models found critical vulnerabilities in PHP
@davewiner Dave Winer on x
PHP is an important foundation of the early web, and it must be preserved.
@autismcapital @autismcapital on x
Apparently there's a patch for the critical PHP vulnerabilities but a few things that are alarming. …
@curtis_yarvin Curtis Yarvin on x
Disclosure of vulnerabilities is no longer the right model. It's a blacklist model. It assumes default security. The right model is a whitelist model. All code with potential security risks has to come with an AI redteaming certificate. Anything that's not like an XML file [embed…
@steipete Peter Steinberger on x
That PHP vulnerability that's gonna cause havoc this week was found with... GPT-5.6 Sol.
@m_adams Michael Adams on x
The PHP incident is more evidence that we're heading toward a new paradigm for existing on the internet. It feels like the future will have much more digital surveillance. [image] [embedded post]
@nicbstme Nicolas Bustamante on x
People don't realize this critical PHP vulnerability was found using GPT-5.6 Sol. We've already moved on to GPT-6 Astra and GPT-6.1. This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover, or the cyb…
@timkellogg.me Mr. Tim on bluesky
openai has a skill to check for the PHP 0day — github.com/openai/php2s...
@masnick.com Mike Masnick on bluesky
Kind of fascinating that both Google and OpenAI are claiming credit for their AI tools discovering (apparently independently) the massive, scary PHP vulnerability that is taking down sites across the internet today. — cloud.google.com/blog/product... openai.com/index/coordi...
r/programiranje r on reddit
OpenAI našao kritičan vulnerability u PHPu, 70% interneta pogodjeno
r/technology r on reddit
The AI-Hacking Apocalypse Began Last Night
@burcs Brandon on x
it's kind of wild to work at a company that can basically flip a switch and protect 20% of the internet from critical vulns [embedded post]
@emily.space Emily Hunt on bluesky
word on the street is that there is *another* PHP vulnerability. — this one was found by something even more powerful for security research than a frontier LLM: a catgirl
@thephpf @thephpf on x
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security https://thephp.foundation/…
@sagitz_ @sagitz_ on x
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are memory corruption issues in PHP's internal error handling (out-of-memory, fatal errors). We've demonstrated that these can be exploited to full RCE or Heartbleed-style memory disclosure, regardless of application logic
@tracewoodgrains Jack on x
Life is basically the same as it was in 2021. This is a normal experience caused by a normal technology. Ordinary people are experiencing no material changes from this mildly useful office productivity software people are calling AI. [image] [embedded post]
@mattparlmer @mattparlmer on x
I have said for years that software engineering is far too undisciplined, looks like we finally have to pay down all the security debt incurred by lazy practices [embedded post]
@sagitz_ @sagitz_ on x
As expected in 2026, AI did most of the work here. This research began with a prompt targeting security flaws in PHP functions reachable from popular codebases. One thing led to another, and we ended up uncovering an entire class of security vulnerabilities in PHP itself🤯
@google @google on x
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
@cloudflare @cloudflare on x
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
@rajeevrc_x Rajeev Chandrasekhar on x
If you were amongst the rare few who believed that Internet was safe & trusted - heres one more reason to change that belief 😁😁😅 #SafeTrustedInternet https://www.wsj.com/...
@mondoab @mondoab on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
@altryne Alex Volkov on x
HugOps to EVERYONE who has deployed PHP 🤞 php2shell is “One of the most severe bugs in open source software found in recent memory” according to Greg Brokman [embedded post]
@so8res Nate Soares on x
It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the “defense will run ahead of offense” theory, especially give that domains like bio are much harsher than cyber.
@alper @alper on x
I'm guessing the exploit leaked because so many people were working on marketing materials around this incident. [embedded post]
@avandeursen@mastodon.acm.org Arie van Deursen on mastodon
Must-read blog post from the PHP foundation: — > [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618. — > the lack of a known path to remote code execution and the small team of core…
@dnvolz Dustin Volz on x
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” https://aws.amazon.com/...
@hdmoore HD Moore on x
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: https://calif.io/...
@calif_io @calif_io on x
Do you know who illustrated the comic on https://calif.io/...? Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!
@naderman Nils Adermann on x
Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
@andrewmohawk @andrewmohawk on x
https://thephp.foundation/... Really disappointing that companies put marketing ahead of safety. [image]
@arvidkahl Arvid Kahl on x
One thing I really don't understand is why, with Cloudflare already reporting attacks, @ThePHPF didn't release their fixes asap. I get the “once patched, the vuln is exploitable on unpatched servers.” But right now, EVERY server is exploitable. Is that better?!
@chainguard_dev @chainguard_dev on x
Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations. To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here: https://images.chainguard.de…
@mikko @mikko on x
@mikko — “On October 21st at 07:41 UTC, more than six hours before the coordinated release …
@sughanthans1 @sughanthans1 on x
aws says a 7-day patch deadline is now too slow for critical bugs in anything facing the internet. it wants teams to measure patching in hours. php2shell shows why. aws's honeypots logged an exploit attempt on october 17, four days before the bug went public. and aws spotted expl…
@lukolejnik Lukasz Olejnik on x
PHPocalypse flaws existing for a decade, identified with the help of AI, let attackers hijack web servers without logging in. Amazon & Cloudflare reported exploitation attempts days before disclosure. Now the flaws are broadly exploited. Cybersecurity agencies (US, UK, EU, you na…
@anthonyronning Anthony Ronning on x
Yeah I mean honestly, a significant CVE where multiple people independently found the vulnerability at nearly the same exact time should not be sat on for 2 months. Not only was this irresponsibly disclosed but it was irresponsibly held back too. I'm not sure how that happens.
@4n6lady @4n6lady on x
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure. Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. https://aws.amazon.com/...
@dinodaizovi Dino A. Dai Zovi on x
Periodic reminder that for every serious, exploitable vulnerability that you find out about and patch, there was some level of exploitation of it *before* then.
@frichette_n Nick Frichette on x
Turns out details leaked even sooner than previously believed. AWS saw exploitation on the 17th! https://aws.amazon.com/...
@gmiller Geoffrey Miller on x
You might just want to stay offline for the next few days, BTW. These newly discovered PHP vulnerabilities are no joke. PHP powers about 70% of the global internet, and these are ‘critical vulnerabilities’. Expect massive data breaches, website outages, malware, and remote hacks …
@rhorider @rhorider on x
The core of Dead Internet Theory is so many bots will flood the open internet …
@lauramiers Laura Miers on x
Heads up, this is something everyone should know about. “AI was powering a ‘race to exploit.’ The next step was the ‘mass compromise of every vulnerable web server on the internet.’” [image] [embedded post]
@vicvijayakumar Vic on x
1995: PHP is dead, learn ColdFusion 2002: PHP is dead, learn ASP .net 2003: PHP is dead, learn Django 2004: PHP is dead, learn Ruby on Rails 2010: PHP is dead, learn Flask 2011: PHP is dead, learn AngularJS 2016: PHP is dead, learn Next.js 2022: PHP is dead, learn Solidity 2026: …
r/programming r on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security
@citrini @citrini on x
I'm kind of worried that we are gonna have massive exploits like every other week [embedded post]
@cyb3rops Florian Roth on x
My concern with the upcoming PHP RCE disclosure is how many systems could remain exposed long after patches become available. Roughly a third of PHP websites still run PHP 5 or 7. Some operators will need to migrate old applications before they can move to a supported release. Ev…
r/wallstreetbets r on reddit
Critical security issue affecting PHP | National Cyber Security Centre
r/ReverseEngineering r on reddit
There isn't an easy exploit for this PHP vulnerability
r/anime_titties r on reddit
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Chronicles