A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

1 hour ago, toucana said:

A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

Thanks for the explanation. I was wondering why the details had been made public before a fix had been applied. A leak, evidently.

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

47 minutes ago, studiot said:

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

I think there are multiple layers to this question. The first is that PHP is maintained by a non-profit. I.e. it is not really something that they sell. The next layer would be folks using PHP. There, the issue I think is that if you implement something in any language, you really have no control over the product itself. You may be liable to apply patches as they are released but that is a fair bit different.

Then there is the general issue of liability for software flaws. I think in most jurisdiction currently, there is a big gap in regulating liability regarding software flaws and tech in general. From what I understand, current licenses basically state that they sell the software as-is and if something goes wrong down the line, it ain't their problem. The only way to deal with it is basically switching vendors. There is now legislation in Europe and elsewhere underway that try to implement mandatory security measures and guidelines regarding how vulnerabilities need to be managed.

A big issue is that historically there has been a huge knowledge gap between legislators and tech companies, resulting a fragmented wild west in terms of what tech is able and allowed to do. And rather obviously, the dangers have shifted massively from when applying software involved using tapes and floppies to a system now which is increasingly cloud-based and connected to everything but legislation is clearly severely lagging behind.

1 hour ago, MigL said:

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

1 hour ago, toucana said:

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

The ‘Railway Hack’ mentioned in that video is described further here:

https://www.youtube.com/watch?v=Cmbz3BinijU

Railway is a cloud-based platform used by software developers to deploy and update applications. Yesterday morning Railway announced that unauthorised third parties had gained access to user environment variables which in turn allowed them to compromise API keys. Railway advised users to rotate their credentials immediately, but many found themselves unable to do so because Railway had  locked down significant parts of their system as they attempted to mitigate the effects of the intrusion.

When news of the PHP2Shell compromise also broke yesterday, many developers who wanted to push critical PHP security updates to apps hosted on the Railway deployment platform found themselves unable to do so.

12 hours ago, toucana said:

With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

Sounds like four security disasters have landed all at once: the PHP remote code execution bugs, eight eMudhra Certificate Authority private keys that were absurdly guessable single-digit integers (yikes), a poisoned LiteLLM supply-chain backdoor stealing API credentials, and a snafu in some Node.js security release. (API credentials are something that helps software applications talk to each other securely.)

I am scrambling for an upgrade atm, as my tablet is a dinosaur running Android 8.1.0 which is no longer supported and missing literally hundreds of patches I could really use now. I was already on the verge of replacing, so this kind of woke me up. Temp moving to a different device until I can get this taken care of. Wifi going off tonight in 5,4,3,2,1...

Charlie Warzel interviewed the guy who helped fix the PHP mess.

If Anything Happens to This Guy … Everyone Is Screwed’

Ondřej Surý was a relatively anonymous volunteer working on PHP security. Then the internet exploded.

https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?gift=43H6YzEv1tnFbOn4MRsWYp_nQAITxxhhDof71uIxMfY&utm_source=copy-link&utm_medium=social&utm_campaign=share

Once the patch was released yesterday, websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote....

7 hours ago, TheVat said:

Charlie Warzel interviewed the guy who helped fix the PHP mess.

If Anything Happens to This Guy … Everyone Is Screwed’

Ondřej Surý was a relatively anonymous volunteer working on PHP security. Then the internet exploded.

https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?gift=43H6YzEv1tnFbOn4MRsWYp_nQAITxxhhDof71uIxMfY&utm_source=copy-link&utm_medium=social&utm_campaign=share

Once the patch was released yesterday, websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote....

From IRC the other night:

At least chewing gum can be applied quietly. Black October seemed to involve making noise prematurely....

https://www.politico.eu/article/the-cyber-flaw-scramble-that-brought-the-ai-threat-to-life/

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said....

23 minutes ago, TheVat said:

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions

" Some people just want to watch the World burn."

Michael Cane ( as Alfred Pennyworth in The Dark Knight 2008 )