AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching
and used—the PHP vulnerabilities before they were disclosed. And of course now everybody's getting in on it. from @lhn.bsky.socialAndrew Couts /@couts:NEW: AWS detected attempts to exploit the PHP vulnerabilities on October 17, four days before they were patched. Logs indicate multiple malicious actors tried to use the flaws. @lhn.bsky.social reports: www.wired.com/story/hacker...
Context & Ripple Effects
PHP’s creators disclosed two critical unauthenticated remote-code-execution flaws affecting web-serving deployments in the PHP2Shell disclosure. AWS telemetry indicating exploitation before that disclosure changes the response from patching a newly public flaw to investigating possible prior compromise. The pattern recalls Log4j attacks observed before mass exploitation, where early attacker activity preceded a broader defensive scramble.
First-order effects
- Affected PHP operators must treat the released security updates as incident-response work as well as patching, because AWS observed attempts to exploit the flaws before the public advisory.
- AWS’s MadPot observations give defenders evidence that PHP2Shell was already being used by multiple malicious actors, rather than existing only as a disclosed vulnerability.
Second-order effects
- Hosting providers and security teams protecting PHP deployments face pressure to search logs and exposed services for pre-patch activity, not merely verify that updates were installed.
- PHP’s disclosure process is tested against an attacker timeline that began before public visibility, increasing the value of independently observed exploitation evidence in vulnerability triage.
Third-order effects
- Broadly deployed web-software flaws are increasingly judged by the gap between attacker discovery and public remediation, not just by their severity rating.
- If early exploitation becomes a recurring feature of major disclosures, vulnerability response will shift further toward continuous exposure monitoring and evidence-backed detection alongside patch management.
The trend: PHP2Shell is part of a trend in which attackers exploit high-impact web vulnerabilities before public advisories turn them into mass patching events.
Related: Enforcement-latency arbitrage · Evidence-Bearing Security Research · PHP · AWS · PHP2Shell disclosure · Log4j zero-day attacks observed early
Related Coverage
- Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot Amazon Web Services · CJ Moses
- AWS says MadPot saw PHP2Shell exploit attempt before public disclosure RuntimeWire · Morgan Laning
- What is PHP2Shell, and why did it force websites around the world offline? The Indian Express · Anagha Jayakumar
- Crypto Firms Say They Don't Use PHP After Critical PHP2Shell Flaw CoinGape · Pardon Joshua
- Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ Financial Times
- Asian governments step up cyber defences after PHP flaw Reuters
- PHP flaw draws millions of exploit attempts, Cloudflare CEO warns Cointelegraph · Zoltan Vardai
- Hackers launch ‘millions’ of attempts to exploit global PHP cyber flaw Politico · Sam Clark
- Global Rush to Fix Security Flaw Uncovered by A.I. Leaves Sites Offline New York Times · Lynsey Chutel
- Researchers Say Hackers Targeted PHP Before Flaws Were Known Bloomberg · Ryan Gallagher
- PHP2Shell Exploitation Started Days Before Patches SecurityWeek · Ionut Arghire
- PHP2Shell: How AI Turns a Stalled PHP Flaw Into a Global Emergency WinBuzzer · Markus Kasanmascheff
- PHP2Shell sparks a global patch panic Metacurity · Cynthia B Brumfield
- Websites across world hit by millions of attempts to exploit PHP code flaw The Guardian
- No, the internet isn't dying due to ‘one of the most significant vulnerabilities of 2026’ - but this is what you need to know TechRadar · Darren Allan
- Usage statistics of PHP for websites W3Techs
- Critical security issue affecting PHP National Cyber Security Centre
- ‘We expect mass attacks to start within 15 minutes of the release’: Web admins braced for emergency PHP updates to plug leaked high-severity holes PC Gamer · Andy Edser
- What is PHP and how has it raised hacking fears? RTÉ
- AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack Fortune · Emily Forlini
- There isn't an easy exploit for this PHP vulnerability Elias Taylor
- How worried should we be about the PHP cybersecurity crisis? Metro.co.uk · Josh Milton
- Hackers Race to Exploit Newly Found PHP Vulnerabilities Worldwide Bitcoin Insider
- PHP security flaws alarm Korean government, companies The Korea Times · Nam Hyun-woo
- Websites close as owners scramble to fix cybersecurity flaws Telegraph
- PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out Decrypt · Jose Antonio Lanz
- Millions of websites at risk? OpenAI's GPT 5.6 Sol finds critical security flaws in PHP, here is all you need to know Digit · Ayushi Jain
- Korea Raises Cyber Alert Level Over Critical PHP Flaws Seoul Economic Daily · Cho Yun-Jin
- AI-detected PHP security flaws disrupt websites, spark warnings across Asia Nikkei Asia
- Websites go dark as AI exposes critical security flaws Oman Observer
- ‘Backbone of the web’: What is PHP and how has it raised AI hacking fears? France 24
- Hackers Launch Mass Attacks on Websites Through Two Vulnerabilities in PHP—the Language That Powers Most Websites Stories Framing the Globe
- UK working to identify exposure after global cyber-security warning BBC · Helen Sullivan
- Google Cloud Warns of Critical PHP Vulnerabilities Affecting Millions of Websites Windows Report · Milan Stanojevic
- PHP security alert: What US and Indian government warnings mean for websites The Indian Express · Bijin Jose
- 3 reasons Wikipedia, hospitals and government sites went dark today TheStreet · Neo
- Global tech firms, govt agencies rush to contain critical PHP security flaws The Hans India · Ians
- “Shutting Down Because We Can't Fix It”: Critical PHP Vulnerability Sparks Aftershocks in Japanese Game Industry Inven Global
- Government Issues Cyber Crisis “Caution” Alert Over PHP Security Flaw... Security Firms Respond The Asia Business Daily · Lee Eunseo
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) SOPHOS
- RCE via OOM corruption GitHub
- Why governments pulled websites offline over the decades-old PHP programming language CNBC · Isabel O'Brien
- Global race to update computers as AI discovers most disruptive hack yet New Scientist · Matthew Sparkes
- PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet TechCrunch · Julie Bort
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk The Register · Jessica Lyons
- Critical Vulnerabilities in PHP Require Immediate Patching CISA · Kev Catalog
- The Day the Internet Was Almost Hacked RedState · Ben Smith
- PHP2Shell Exploitation: Two Critical PHP Flaws Explained Recorded Future
- Runtime: The PHP noise and signal. The Stack Summit: A Chatham House rule sanity check The Stack · Edward Targett
- Alert - AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 Canadian Centre for Cyber Security
- PHP rushed emergency patch after critical RCE flaws leaked online Neowin · Paul Hill
- CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk CryptoPotato · Wayne Jones
- PHP Fixes a Memory Bug Flagged in 2024 After AI Turned It Into a Working Exploit Implicator.ai · Marcus Schuler
- PHP Patches Critical PHP2Shell Vulnerabilities as Hosts Across the WordPress Ecosystem Race to Protect Customers The Repository · Rae Morey
- PHP2Shell Exposes the Maintenance Challenge Behind AI Bug Hunting The Neuron · Marianne Sison
- What is PHP, and how bad is the computer language flaw causing website shutdowns globally? The Guardian · Josh Taylor
- Today's PHP security release, and how we're strengthening security Hacker News
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) NCSC-NL on GitHub
- php2shell: What we know about the leaked critical PHP RCEs (CVE-2026-109618, CVE-2026-109619) Hadrian
- Tech And Security Companies Respond To PHP2Shell Vulnerabilities SecurityWeek · Eduard Kovacs
- AI uncovers critical PHP security flaws: Why website owners must patch servers immediately Business Today
- PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure Infosecurity · Kevin Poireault
- Websites shut down globally as PHP flaws trigger millions of attack attempts Türkiye Today
- php2shell: Critical flaws allow code injection in PHP heise online · Dr. Christopher Kunz
- October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks Cyber Security News · Guru Baran
- Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond CNBC · Jenny Lee
- Amazon says PHP2Shell exploitation began 4 days before patches BleepingComputer · Sergiu Gatlan
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure The Register · Carly Page
- PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August Wall Street Journal · Robert McMillan
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you Daily Mail · Wiliam Hunter
- Upcoming Critical PHP Security Release PHP
- CZ Warns Crypto Users to Be “Extra Careful”: PHP Vulnerabilities Hit the Code Behind 70% of Websites Coinspeaker · Daniel Francis
- Governments, companies rush to fix PHP-related flaws Daily Sabah
- The entire internet is officially in crisis mode Polygon.com · Patricia Hernandez
- PHP's development team plans to release patches on Wednesday at 10am ET to fix two vulnerabilities, each rated 9.2; watchTowr researchers say they are RCE flaws BleepingComputer · Lawrence Abrams
- A report claims exploit tool PHP2Shell enables RCE on PHP sites; watchTowr says two vulnerabilities affect every version since PHP 5, which was released in 2004 Ars Technica · Dan Goodin
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- Amazon Logged a PHP2Shell Exploit Attempt Four Days Before Disclosure Implicator.ai · Marcus Schuler
- Explained: What are the two PHP vulnerabilities behind a global rush to update and why it matters MediaNama · Azdhan
- The AI Apocalypse Has a Working Prototype Shelly Palmer
- PHP ships emergency patches for critical PHP2Shell flaws BleepingComputer · Sergiu Gatlan
- PHP security alert: Why CERT-In, FBI, Google and OpenAI are warning users and how to fix it Digit · Vikas Yadav
- Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure Cloudflare
- PHP vulnerabilities spark global scramble as websites taken down ITPro · Ross Kelly
- Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched Cyber Security News · Tushar Subhra Dutta
- Critical PHP vulnerabilities send organizations scrambling to secure their systems SiliconANGLE · Maria Deutscher
- AI assisted audit uncovers PHP flaw exposing up to 70% of websites AI Policy Daily
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities Central Security Service · National Security Agency
- Websites scramble to fix software flaw that could put much of internet at risk Washington Post
- Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore's cybersecurity chief The Business Times
- PHP security flaw: Websites taken down as OpenAI spots issue with backbone of internet The National · Cody Combs
- Binance founder CZ warns crypto users over critical PHP security flaws crypto.news · Rony Roy
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- What Is PHP? Why Are Government and Business Websites Going Offline? New York Times
- eMudhra to Exit global SSL/TLS Certificate Business eMudhra Limited
- eMudhra kills its certificate business after researchers cracked its private keys in under a second CyberScoop · Greg Otto
- eMudhra to exit global SSL/TLS certificate business after controversy The Economic Times
- eMudhra to exit global SSL/TLS certificate business after security incident Business Today
- eMudhra to exit global website security certificate business after key-generation flaw Moneycontrol
- eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure Cyber Security News · Guru Baran
- eMudhra to stop issuing SSL/TSL certificates after security lapse triggers worldwide alarm The Indian Express
- Little-known eMudhra set the internet on red alert. What really happened? Livemint · Shouvik Das
- eMudhra security incident explained: What is PKI, what went wrong and how serious are the risks? Storyboard18 · Chehneet Kaur
- eMudhra shares fall 17% as MeitY probes PKI security incident; here's what happened Fortune India · Tamanna Mohanty
- eMudhra CA compromise: eight private keys, and one of them is 4 Aikido Security's Blog · Jorian Woltjer
- eMudhra to Exit Global SSL/TLS Certificate Business AIM · Supreeth Koundinya
- A private key with the value 4: IFF writes to eMudhra, CERT-In and MeitY on the compromise of eMudhra's certificate authority keys Internet Freedom Foundation
- 8 eMudhra certificates are compromised. Here's what you need to know Cloudflare
- A company that vouches for websites had secret keys so weak that 8 of them were cracked CoinDesk
- Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them Ars Technica · Dan Goodin
- Cloudflare sees millions of exploit attempts after PHP disclosure Reuters
- Coinbase, Bitgo Say Unaffected by PHP Flaw; Binance's CZ Urges Caution Bitcoin News · Linas Kmieliauskas
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- Why did huge swathes of the internet suddenly go offline yesterday? The Irish Times · Stephen Conneely
- 110,000 Korean Servers Exposed to Critical PHP Flaws Seoul Economic Daily
- PHP security flaws explained: Affected versions, how to fix and more details Digit · Ayushi Jain
- PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports Security Affairs · Pierluigi Paganini
- AI Discovers Critical Security Flaw Affecting Technology Behind 70% Of All Websites ZeroHedge News · Tyler Durden
- The Internet Is Currently On Fire Kotaku · Lewis Parker
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- PHP security flaws trigger global scramble; CERT-In flags critical vulnerabilities Times of India · Shilpa Phadnis
- The disastrous PHP vulnerabilities were exploited days before the patch The Verge · Emma Roth
- Amazon Threat Intel saw PHP2Shell exploit attempts on 17-Oct, four days before public disclosure. For affected: patch urgently *and* investigate back to at least 17-Oct for signs of compromise: https://aws.amazon.com/... @joebeone@techpolicy.social · Joseph Lorenzo Hall, PhD
- Race to update services' computer systems after cyber-security flaw found BBC · Tom Gerken
- Cloudflare Reports Millions of Exploit Attempts After PHP Flaws Disclosed PYMNTS.com
- Quest Diagnostics Reports Unauthorized Access of Patient Records Gizmodo · Matt Novak
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- There's an internet-wide security crisis, but crypto might actually be ahead of the curve Yahoo Finance
- Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws Korea JoongAng Daily · Sung Ji-Won
- The internet's hidden security nightmare — and how AI exposed it Axios · Herb Scribner
- 911 Outages Hit Multiple Cities in California Gizmodo · Matt Novak
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- Firms Race to Fix Widespread Cyber Flaw Before Hackers Break In Bloomberg Law · Ryan Gallagher
- 2026 PHP Vulnerability / Hack Know Your Meme · Phillip Hamilton
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure Hacker News
- Hackers appear to be struggling to exploit PHP flaws after global cybersecurity crisis NBC News · Kevin Collier
Analysis
Discussion
-
@brbarrett
Brian Barrett
on bluesky
At least one hacker found—and used—the PHP vulnerabilities before they were disclosed. And of course now everybody's getting in on it. from @lhn.bsky.social
-
@couts
Andrew Couts
on bluesky
NEW: AWS detected attempts to exploit the PHP vulnerabilities on October 17, four days before they were patched. Logs indicate multiple malicious actors tried to use the flaws. @lhn.bsky.social reports: www.wired.com/story/hacker...
-
@dnvolz
Dustin Volz
on x
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” https://aws.amazon.com/...
-
@sughanthans1
@sughanthans1
on x
aws says a 7-day patch deadline is now too slow for critical bugs in anything facing the internet. it wants teams to measure patching in hours. php2shell shows why. aws's honeypots logged an exploit attempt on october 17, four days before the bug went public. and aws spotted expl…
-
@lukolejnik
Lukasz Olejnik
on x
PHPocalypse flaws existing for a decade, identified with the help of AI, let attackers hijack web servers without logging in. Amazon & Cloudflare reported exploitation attempts days before disclosure. Now the flaws are broadly exploited. Cybersecurity agencies (US, UK, EU, you na…
-
@anthonyronning
Anthony Ronning
on x
Yeah I mean honestly, a significant CVE where multiple people independently found the vulnerability at nearly the same exact time should not be sat on for 2 months. Not only was this irresponsibly disclosed but it was irresponsibly held back too. I'm not sure how that happens.
-
@4n6lady
@4n6lady
on x
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure. Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. https://aws.amazon.com/...
-
@dinodaizovi
Dino A. Dai Zovi
on x
Periodic reminder that for every serious, exploitable vulnerability that you find out about and patch, there was some level of exploitation of it *before* then.
-
@frichette_n
Nick Frichette
on x
Turns out details leaked even sooner than previously believed. AWS saw exploitation on the 17th! https://aws.amazon.com/...
-
@jeremy_kirk
Jeremy Kirk
on x
Amazon detected PHP2Shell exploitation on a honeypot four days before public disclosure: https://aws.amazon.com/...
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
@chainguard_dev
@chainguard_dev
on x
Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations. To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here: https://images.chainguard.de…
-
@naderman
Nils Adermann
on x
Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
-
@andrewmohawk
@andrewmohawk
on x
https://thephp.foundation/... Really disappointing that companies put marketing ahead of safety. [image]
-
@mikko
@mikko
on x
@mikko — “On October 21st at 07:41 UTC, more than six hours before the coordinated release …
-
@arvidkahl
Arvid Kahl
on x
One thing I really don't understand is why, with Cloudflare already reporting attacks, @ThePHPF didn't release their fixes asap. I get the “once patched, the vuln is exploitable on unpatched servers.” But right now, EVERY server is exploitable. Is that better?!
-
@thephpf
@thephpf
on x
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security https://thephp.foundation/…
-
@marypcbuk
Mary Branscombe
on bluesky
PHP Foundation kind of found the first vuln in 2024 but “the PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice” — don't dunk on a bunch of volunteers for that; dunk on everyone depending on but…
-
@lookitup.baby
Ian Coldwater
on bluesky
The leak wasn't OpenAI's fault. Chainguard unilaterally broke the embargo by releasing built images with fixes before the vulnerabilities were disclosed, forcing maintainers to scramble to release the patches early. — This industry is small and you just can't treat people like…
-
@avandeursen@mastodon.acm.org
Arie van Deursen
on mastodon
Must-read blog post from the PHP foundation: — > [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618. — > the lack of a known path to remote code execution and the small team of core…
-
r/programming
r
on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security
-
r/cybersecurity
r
on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
-
@dok2001
Dane Knecht
on x
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
-
@eastdakota
Matthew Prince
on x
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
-
@burcs
Brandon
on x
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
-
@google
@google
on x
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
-
@eastdakota
Matthew Prince
on x
We had to invent a new form of WAF to mitigate this latest set of vulnerabilities. Now enabled by default for all customers for free.
-
@mitsuhiko
Armin Ronacher
on x
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. https://x.com/... [embedded post]
-
@rhyssullivan
Rhys
on x
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
-
@cloudflare
@cloudflare
on x
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
-
@dok2001
Dane Knecht
on x
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New ru…
-
@burcs
Brandon
on x
it's kind of wild to work at a company that can basically flip a switch and protect 20% of the internet from critical vulns [embedded post]
-
@tridevgurung
Tridev Gurung
on x
we've temporarily taken buymemomo offline as a precaution, which is why you'll be seeing this screenshot. …
-
@alphaque
Dinesh Nair
on x
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…
-
@uwu_underground
@uwu_underground
on x
Step 1. Fuzz your CloudFlare servers to figure out what gets filtered at the WAF level Step 2. reverse engineer a vulnerability Step 3. Profit [embedded post]
-
@arvidkahl
Arvid Kahl
on x
Another reminder of why our $5/month is extremely well spent. [embedded post]
-
@cstanley
Christopher Stanley
on x
Thanks Dane, Cloudflare has always been a huge shield for the public. Appreciate you all so much. [image] [embedded post]
-
@blackroomsec
@blackroomsec
on x
Reposting this from my own comment so you all see it. Re: PHP patch today. …
-
watchTowr
watchTowr
on linkedin
🚨 Yesterday, information leaked about two Remote Code Execution vulnerabilities in PHP, now known as “PHP2Shell” (CVE-2026-109618 …
-
r/anime_titties
r
on reddit
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
-
r/cybersecurity
r
on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
-
r/GeminiAI
r
on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
-
@mattburgess1
Matt Burgess
on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
r/kubernetes
r
on reddit
PHP blames Chainguard for putting huge chunks of the web at risk
-
r/PHP
r
on reddit
Today's PHP Security Release, and How We're Strengthening PHP Security
-
Giovanni Ferraz
Giovanni Ferraz
on linkedin
Someone tried to exploit PHP2Shell four days before it was disclosed. — On October 21, PHP shipped emergency fixes for two flaws in its core runtime, CVE-2026-109618 and CVE-2026-109619. …
-
Peter White
Peter White
on linkedin
70% of the world's websites depend on PHP, and the National Security Agency has just issued an urgent advisory regarding two critical vulnerabilities. …
-
CJ Moses
CJ Moses
on linkedin
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), known as PHP2Shell, are being broadly exploited in the wild. …
-
@mciabuca
Mike
on x
@Techmeme @abhiiswriting my phone pin has more bits than that
-
@bee_fumo
@bee_fumo
on x
Holy fucking shit it actually killed them. https://www.reuters.com/... [image]
-
r/IndianStreetBets
r
on reddit
eMudhra to exit global website security certificate business after key-generation flaw
-
r/LinusTechTips
r
on reddit
Can't make this shitup, Indian CA's root private certificate fiasco
-
@ctrlaltdwayne
Dwayne
on x
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have th…
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
@ericjgeller.com
Eric Geller
on bluesky
Amazon says its telemetry shows attempts to exploit the PHP vulnerabilities on Oct. 17, four days before they were disclosed. aws.amazon.com/blogs/securi...
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...
-
@bettycjung
Betty C. Jung
on bluesky
Millions of hacking attempts as companies, governments rush to patch PHP flaws www.reuters.com/world/asia-p...
-
r/PrepperIntel
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/news
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/worldnews
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws