A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

1 hour ago, toucana said:

A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

Thanks for the explanation. I was wondering why the details had been made public before a fix had been applied. A leak, evidently.

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

47 minutes ago, studiot said:

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

I think there are multiple layers to this question. The first is that PHP is maintained by a non-profit. I.e. it is not really something that they sell. The next layer would be folks using PHP. There, the issue I think is that if you implement something in any language, you really have no control over the product itself. You may be liable to apply patches as they are released but that is a fair bit different.

Then there is the general issue of liability for software flaws. I think in most jurisdiction currently, there is a big gap in regulating liability regarding software flaws and tech in general. From what I understand, current licenses basically state that they sell the software as-is and if something goes wrong down the line, it ain't their problem. The only way to deal with it is basically switching vendors. There is now legislation in Europe and elsewhere underway that try to implement mandatory security measures and guidelines regarding how vulnerabilities need to be managed.

A big issue is that historically there has been a huge knowledge gap between legislators and tech companies, resulting a fragmented wild west in terms of what tech is able and allowed to do. And rather obviously, the dangers have shifted massively from when applying software involved using tapes and floppies to a system now which is increasingly cloud-based and connected to everything but legislation is clearly severely lagging behind.

1 hour ago, MigL said:

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

1 hour ago, toucana said:

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

The ‘Railway Hack’ mentioned in that video is described further here:

https://www.youtube.com/watch?v=Cmbz3BinijU

Railway is a cloud-based platform used by software developers to deploy and update applications. Yesterday morning Railway announced that unauthorised third parties had gained access to user environment variables which in turn allowed them to compromise API keys. Railway advised users to rotate their credentials immediately, but many found themselves unable to do so because Railway had  locked down significant parts of their system as they attempted to mitigate the effects of the intrusion.

When news of the PHP2Shell compromise also broke yesterday, many developers who wanted to push critical PHP security updates to apps hosted on the Railway deployment platform found themselves unable to do so.

12 hours ago, toucana said:

With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

Sounds like four security disasters have landed all at once: the PHP remote code execution bugs, eight eMudhra Certificate Authority private keys that were absurdly guessable single-digit integers (yikes), a poisoned LiteLLM supply-chain backdoor stealing API credentials, and a snafu in some Node.js security release. (API credentials are something that helps software applications talk to each other securely.)

I am scrambling for an upgrade atm, as my tablet is a dinosaur running Android 8.1.0 which is no longer supported and missing literally hundreds of patches I could really use now. I was already on the verge of replacing, so this kind of woke me up. Temp moving to a different device until I can get this taken care of. Wifi going off tonight in 5,4,3,2,1...