There you have it! The PHP project shipped emergency patches this morning, Oct. 21, for two criti…
October 21, 2026 · 0 likes · 0 comments
AI Cybersecurity
There you have it! The PHP project shipped emergency patches this morning, Oct. 21, for two critical flaws that let an attacker with no account run code on a web server.
They're nicknamed PHP2Shell. CVE-2026-109618 and CVE-2026-109619. Both rated 9.2 on the CVSS v4.0 scale.
The bugs sit in the PHP engine itself, not in anyone's website code. Per the PHP advisory, even a bare "Hello World" page can be attacked.
PHP runs nearly 7 in 10 websites whose server-side language is known, according to W3Techs. WordPress, Drupal, Magento and Joomla all sit on top of it.
What happened, in order:
• Details leaked Tuesday afternoon, ahead of the planned patch.
• Cloudflare reported early attacks at 07:43 UTC Wednesday, more than six hours before the fix shipped, according to Sansec.
• Pinboard, parts of Wikipedia, 4Chan and Something Awful took themselves offline rather than wait.
• The UK's National Cyber Security Centre urged organizations to consider taking offline any system they can't fix right away.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
"There are no complete mitigations, updating is the only safe choice," the PHP Foundation wrote.
Two things admins keep getting wrong:
Updating WordPress or Laravel does NOT update the PHP runtime underneath it. That comes from your host, your server package or your container image. And restart Apache, PHP-FPM and any long-running workers after you patch.
PHP 8.1 and older get no official release. The project published minimal source backports for 7.4, 8.0 and 8.1, and some distributions ship their own. Everyone else is the long tail.
Who found it? Researchers at Wiz, Calif and OpenAI. Wiz said the bugs had been there for decades, and that frontier AI models substantially lowered the barrier to turning them into a working exploit.
PHP is where I started. I was an early PHP contributor at 14. I started with Assembly and C++, then moved to PHP. It's what I built my first companies on, including our own CMS.
So I'm not here to dunk on PHP. It earned its place. It still runs most of the web.
That's exactly the problem.
The bugs were old. What changed is the cost of weaponizing them. Same AI, two stories: one team calls it faster defense, another says it makes attacking dangerously fast. Both are right.
Which means every "we'll upgrade next quarter" server is now on a much shorter clock. PHP 8.2 reaches end of life on Dec. 31, 2026. If you're still on 8.1 or older, you're not saving money. You're borrowing it.
Patch today. Then find the boxes nobody remembers owning.
Full story, with the sources: https://lnkd.in/eQhMk6ps
We covered PHP2Shell on today's Unbiased Headlines Podcast Daily (Oct. 21). Facts. Not spin. Free to listen, on Apple Podcasts, Spotify, YouTube Music and iHeart: https://lnkd.in/e8inH2cE
They're nicknamed PHP2Shell. CVE-2026-109618 and CVE-2026-109619. Both rated 9.2 on the CVSS v4.0 scale.
The bugs sit in the PHP engine itself, not in anyone's website code. Per the PHP advisory, even a bare "Hello World" page can be attacked.
PHP runs nearly 7 in 10 websites whose server-side language is known, according to W3Techs. WordPress, Drupal, Magento and Joomla all sit on top of it.
What happened, in order:
• Details leaked Tuesday afternoon, ahead of the planned patch.
• Cloudflare reported early attacks at 07:43 UTC Wednesday, more than six hours before the fix shipped, according to Sansec.
• Pinboard, parts of Wikipedia, 4Chan and Something Awful took themselves offline rather than wait.
• The UK's National Cyber Security Centre urged organizations to consider taking offline any system they can't fix right away.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
"There are no complete mitigations, updating is the only safe choice," the PHP Foundation wrote.
Two things admins keep getting wrong:
Updating WordPress or Laravel does NOT update the PHP runtime underneath it. That comes from your host, your server package or your container image. And restart Apache, PHP-FPM and any long-running workers after you patch.
PHP 8.1 and older get no official release. The project published minimal source backports for 7.4, 8.0 and 8.1, and some distributions ship their own. Everyone else is the long tail.
Who found it? Researchers at Wiz, Calif and OpenAI. Wiz said the bugs had been there for decades, and that frontier AI models substantially lowered the barrier to turning them into a working exploit.
PHP is where I started. I was an early PHP contributor at 14. I started with Assembly and C++, then moved to PHP. It's what I built my first companies on, including our own CMS.
So I'm not here to dunk on PHP. It earned its place. It still runs most of the web.
That's exactly the problem.
The bugs were old. What changed is the cost of weaponizing them. Same AI, two stories: one team calls it faster defense, another says it makes attacking dangerously fast. Both are right.
Which means every "we'll upgrade next quarter" server is now on a much shorter clock. PHP 8.2 reaches end of life on Dec. 31, 2026. If you're still on 8.1 or older, you're not saving money. You're borrowing it.
Patch today. Then find the boxes nobody remembers owning.
Full story, with the sources: https://lnkd.in/eQhMk6ps
We covered PHP2Shell on today's Unbiased Headlines Podcast Daily (Oct. 21). Facts. Not spin. Free to listen, on Apple Podcasts, Spotify, YouTube Music and iHeart: https://lnkd.in/e8inH2cE