A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

1 hour ago, toucana said:

A YouTube video by a researcher called Dr Josh C. Simmons offers a reasonably accessible account of two newly discovered PHP vulnerabilities that have been shutting down government websites around the world in the last 24 hours

https://www.youtube.com/watch?v=5k-RksX8SR0

The two vulnerabilities CVE-2026-109-618  and CVE-2026-109-619 are both assigned a CVSS v4.0 score of 9.2(Critical) and are collectively  known as “PHP2Shell”. They allow an unauthenticated, remote attacker to execute arbitrary code and potentially take complete control of a web server without needing any login credentials.

They were first discovered back in August. Patches had been prepared in September and were scheduled for release on Thursday 22 October, but news of the vulnerabilities leaked early on Tuesday 20th, forcing PHP to issue an emergency bulletin yesterday before the patches were available. With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

The AI assisted research which spotted these PHP vulnerabilities has also flagged up a jaw-dropping problem with an Indian CA (Certification Authority) called eMudrha

https://www.youtube.com/watch?v=ehcBwqyUGjo

They were apparently using ‘4’  as one of their intermediate private keys.

Thanks for the explanation. I was wondering why the details had been made public before a fix had been applied. A leak, evidently.

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

47 minutes ago, studiot said:

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

I think there are multiple layers to this question. The first is that PHP is maintained by a non-profit. I.e. it is not really something that they sell. The next layer would be folks using PHP. There, the issue I think is that if you implement something in any language, you really have no control over the product itself. You may be liable to apply patches as they are released but that is a fair bit different.

Then there is the general issue of liability for software flaws. I think in most jurisdiction currently, there is a big gap in regulating liability regarding software flaws and tech in general. From what I understand, current licenses basically state that they sell the software as-is and if something goes wrong down the line, it ain't their problem. The only way to deal with it is basically switching vendors. There is now legislation in Europe and elsewhere underway that try to implement mandatory security measures and guidelines regarding how vulnerabilities need to be managed.

A big issue is that historically there has been a huge knowledge gap between legislators and tech companies, resulting a fragmented wild west in terms of what tech is able and allowed to do. And rather obviously, the dangers have shifted massively from when applying software involved using tapes and floppies to a system now which is increasingly cloud-based and connected to everything but legislation is clearly severely lagging behind.

1 hour ago, MigL said:

These vulnerabilities were uncovered with AI assistance.
Are they now doing 'gain of function' research with computational routines ?
What could possibly go wrong ?

I am reminded of Agent ( where have I heard that term ? ) Smith's evolution in Matrix II and III )

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

1 hour ago, toucana said:

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

The ‘Railway Hack’ mentioned in that video is described further here:

https://www.youtube.com/watch?v=Cmbz3BinijU

Railway is a cloud-based platform used by software developers to deploy and update applications. Yesterday morning Railway announced that unauthorised third parties had gained access to user environment variables which in turn allowed them to compromise API keys. Railway advised users to rotate their credentials immediately, but many found themselves unable to do so because Railway had  locked down significant parts of their system as they attempted to mitigate the effects of the intrusion.

When news of the PHP2Shell compromise also broke yesterday, many developers who wanted to push critical PHP security updates to apps hosted on the Railway deployment platform found themselves unable to do so.

12 hours ago, toucana said:

With up to 70% of the websites in the world relying on PHP code, the problem became so urgent that NSA among others was warning owners to to take their websites offline until they could be patched. Hence the worldwide scramble.

Sounds like four security disasters have landed all at once: the PHP remote code execution bugs, eight eMudhra Certificate Authority private keys that were absurdly guessable single-digit integers (yikes), a poisoned LiteLLM supply-chain backdoor stealing API credentials, and a snafu in some Node.js security release. (API credentials are something that helps software applications talk to each other securely.)

I am scrambling for an upgrade atm, as my tablet is a dinosaur running Android 8.1.0 which is no longer supported and missing literally hundreds of patches I could really use now. I was already on the verge of replacing, so this kind of woke me up. Temp moving to a different device until I can get this taken care of. Wifi going off tonight in 5,4,3,2,1...

Charlie Warzel interviewed the guy who helped fix the PHP mess.

If Anything Happens to This Guy … Everyone Is Screwed’

Ondřej Surý was a relatively anonymous volunteer working on PHP security. Then the internet exploded.

https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?gift=43H6YzEv1tnFbOn4MRsWYp_nQAITxxhhDof71uIxMfY&utm_source=copy-link&utm_medium=social&utm_campaign=share

Once the patch was released yesterday, websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote....

7 hours ago, TheVat said:

Charlie Warzel interviewed the guy who helped fix the PHP mess.

If Anything Happens to This Guy … Everyone Is Screwed’

Ondřej Surý was a relatively anonymous volunteer working on PHP security. Then the internet exploded.

https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?gift=43H6YzEv1tnFbOn4MRsWYp_nQAITxxhhDof71uIxMfY&utm_source=copy-link&utm_medium=social&utm_campaign=share

Once the patch was released yesterday, websites everywhere went offline to implement the fix. These included government websites in Germany and Finland, some hospital and school websites in Europe, and international sites such as 4chan. During this race to secure the majority of the internet, I noticed one name pop up in posts on Reddit and X: Ondřej Surý.

“Explaining to my wife how there’s this one guy. And he alone is responsible for most of the world’s distribution of PHP,” a software developer named Ian Landsman wrote on X. “And if anything happens to this guy, that’s just it. Everyone is screwed.” He was referring to Surý.

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote....

From IRC the other night:

At least chewing gum can be applied quietly. Black October seemed to involve making noise prematurely....

https://www.politico.eu/article/the-cyber-flaw-scramble-that-brought-the-ai-threat-to-life/

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said....

23 minutes ago, TheVat said:

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions

" Some people just want to watch the World burn."

Michael Cane ( as Alfred Pennyworth in The Dark Knight 2008 )

On 10/25/2026 at 9:13 AM, MigL said:

" Some people just want to watch the World burn."

Michael Cane ( as Alfred Pennyworth in The Dark Knight 2008 )

That's a little synchronicity - this morning, I iust quoted that famous line on another forum, in another context of techno menace. Alfred's comment has never seemed more timely, as I watch the tech bros keep launching their crazy whims at us. Intellect and hubris, without the checks and balances of conscience or emotional maturity.

Edited October 26Oct 26 by TheVat
Dobjeoshtiejf gusidodfugu ruskxkcufdhsydfgsgshsgduud

42 minutes ago, TheVat said:

That's a little synchronicity - this morning, I iust quoted that famous line on another forum, in another context of techno menace. Alfred's comment has never seemed more timely, as I watch the tech bros keep launching their crazy whims at us. Intellect and hubris, without the checks and balances of conscience or emotional maturity.

Very much what the pope says in his encyclical, which I am in the middle of wading through. Building a Tower of Babel.

The State needs to wake up and control these people.

Edited October 26Oct 26 by exchemist

On 10/22/2026 at 9:43 PM, MigL said:

These vulnerabilities were uncovered with AI assistance.

It’s easier than you might think. You give an LLM/AI a piece of code—even code that it generated itself—and ask, "What problems do you see here?" It then starts looking for them. It’s the very same code it provided earlier (after you asked it to write something), yet it’s full of errors. The AI might point one out, saying, "Oh, I see an error here, because of such-and-such..." You reply, "But you generated this code; I didn't write it." The AI then responds, "Oh, sorry, you're right—here is the final version of the code [...]"—to which you point out (if you know your stuff!) that there’s another error. This whole process can go on for hours..

Running automated code analysis quickly uncovers errors in the code—especially when the source code is available, as is the case here. For humans to perform this same task, it would require thousands of people per project and entail enormous costs.

On 10/22/2026 at 9:53 PM, studiot said:

Well I wonder.

If I designed and manufactured a car with say a defective steering linkage, which cause accidents, damage and injury.

Would I not be liable or even criminally liable ?

Why are IT firms any different ?

Every electrical or mechanical device has some issue that manifests only under extreme conditions—conditions in which most people never actually use it—causing it to stop working. The same applies to code. Such bugs only appear in extreme scenarios, because the obvious bugs were already caught at an earlier stage.

"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."

"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."

How is it typical scenario?

Your car cannot fly or swim either.. direct your complaints to the manufacturer..

On 10/22/2026 at 10:59 PM, CharonY said:

A big issue is that historically there has been a huge knowledge gap between legislators and tech companies, resulting a fragmented wild west in terms of what tech is able and allowed to do. And rather obviously, the dangers have shifted massively from when applying software involved using tapes and floppies to a system now which is increasingly cloud-based and connected to everything but legislation is clearly severely lagging behind.

Legislation has no bearing here. In a project developed for free, there’s usually just one programmer doing everything—and they don’t necessarily have to be an expert in every aspect—often working on it during their spare time, outside of their regular job. If someone doesn’t want to use it, they don’t have to; there’s no compulsion. The catch is that those who do use it often feel they have no choice, as there’s no easy alternative. In commercial IT, software is written in a way that makes it easy to replace the programmer; they spend more time on paperwork and documenting every function they write. Employee turnover in IT is very high—it’s rare for someone to stay at the same company for more than a few years. Once they leave, no one touches their code because, in reality, no one knows what’s actually going on inside it—unless it was thoroughly described in documentation or code comments (which, historically, was rarely done). Personally, for instance, I almost never write comments or waste time on such nonsense.

People get bored; they want a higher salary or a new challenge rather than doing the same thing over and over, so they change jobs. According to Google Gemini, the average tenure at a single company is 24–36 months.

When someone like that comes along, no one knows what was in their code or how to fix it. Often, the code ends up being rewritten from scratch, because analyzing it to fully understand everything would simply take too much time.

Code generated by an LLM/AI—now that is truly buggy! You could find fault with every single line...

Back in the days of floppy disks and CDs, much greater care was taken to ensure code was free of errors—because once a product was released, it couldn't be updated or patched via the Internet.

On 10/22/2026 at 10:59 PM, toucana said:

One problem is that code patches issued by PHP can themselves be reverse engineered by hackers using AI vibecoding tools to reconstruct the exact vulnerabilities the patches were supposed to be addressing, and the hackers can then retarget swarms of hostile AI agents onto those vulnerabilities with even greater force.

Once a CVE is in the vulnerability database (21 October), anyone who can read English can recreate an exploit; there’s no need to analyze the code of the patch—though "patch" isn't really the right word here, as it involves shipping an entirely new, fresh php.exe. and not something like Windows-style patches. In the case of Windows, analyzing such a patch—had it not been included in a CVE—would actually make sense.

Edited Friday at 02:21 PM2 days by Sensei

On 10/22/2026 at 10:59 PM, toucana said:

This in part is what ‘doomers’ like this PHP programmer are talking about 24 hours after the “AI-pocalypse” began:

https://www.youtube.com/watch?v=2iMdoDZap7c

Wow. What a load of nonsense.. This guy is a lamer..

To disable vulnerability in PHP without (temporarily) patching anything you just need to modify php.ini:

; CVE-2026-109619
session.upload_progress.enabled = 0

; CVE-2026-109619 – PHP 8.5 only
fatal_error_backtraces = 0

; CVE-2026-109618
memory_limit = -1

; POST size limit
post_max_size = 8M
upload_max_filesize = 4M

; Variables limit
max_input_vars = 1000

In some other config files:

php_admin_flag[session.upload_progress.enabled] = off

php_admin_flag[fatal_error_backtraces] = off

And Apache:

LimitRequestBody 1048576

or Nginx:

client_max_body_size 1m;

This removes known attack vectors for PHP.

On 10/25/2026 at 3:44 PM, TheVat said:

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Which was completely unnecessary, as it would have sufficed to prevent out-of-memory errors by simply adjusting a few configuration files (as in the procedure above).

Cloudflare did exactly that, and their proxy servers were immediately secured. To reach the servers behind the proxy, hackers would have needed to possess their actual IPv6 addresses, and the servers would have had to be misconfigured (as they still are!).

On 10/25/2026 at 3:44 PM, TheVat said:

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said....

They saw it because they had implemented limits on GET and POST data. They blocked this data to prevent it from reaching their clients' servers, ensuring it wouldn't trigger out-of-memory conditions or cause a longjmp() to be executed.

From your later post about "tech bros", I conclude that you didn't understand any of it, since you blame these "tech bros" for something.. And they protected your ass..

Charmed, as always. Thanks for stopping by, oh wise master.

12 hours ago, Sensei said:

From your later post about "tech bros", I conclude that you didn't understand any of it, since you blame these "tech bros" for something.. And they protected your ass..

The 'Tech Bros' are trying to make society more and more dependent on digital infrastructure.
Why do you think they are putting Billions and Billions into AI and data center/server farms.
Then when something goes 'wrong', they step in to provide the 'solution'.

The Mob used to call that a 'protection racket'.

2 hours ago, MigL said:

The 'Tech Bros' are trying to make society more and more dependent on digital infrastructure.
Why do you think they are putting Billions and Billions into AI and data center/server farms.
Then when something goes 'wrong', they step in to provide the 'solution'.

In every industrial sector, they aim to become a monopolist and make their customers dependent on their products, as this ensures reliable, annual profits—which are essential for the company’s operations and for covering the costs of all their highly expensive specialists.

In every industry, the goal is to increase revenues and profits year after year. A manager who shows a decline will simply be dismissed as ineffective. So don't blame IT, blame capitalism. That's how it works.

Why is there a new version of Android and a new version of iOS every single year? Because companies hire programmers who need to be paid—otherwise, they might leave for somewhere else. IT companies are prisoners of progress.

Everyone thought Microsoft was on a downward slope—giving Windows away for free, or nearly for free (I personally download it as an ISO and use it in a VM at no cost, and everything works fine). But their cloud and AI services have breathed new life into the company. Microsoft is the largest shareholder in OpenAI, providing the cloud infrastructure needed to run their models. They also grant access to their search engine, allowing the models to retrieve data from the internet. Since OpenAI is not publicly traded, it remains insulated from stock market volatility.

If there’s no progress in a company, there’s a decline. Year after year, employees demand more and more for their work. Inflation is driving up the prices of everything. If the IT sector fails to create new products, it’s game over for them.

Blame capitalism.

7 hours ago, Sensei said:

Blame capitalism

One could do that (and even might be correct) but in the US it would mostly fall on deaf ears.

10 hours ago, MigL said:

Why do you think they are putting Billions and Billions into AI and data center/server farms.

And here I thought it was so they could keep everyone in the world under surveillance 24/7. 😉

On 11/7/2026 at 9:57 AM, npts2020 said:

And here I thought it was so they could keep everyone in the world under surveillance 24/7. 😉

It's and, not or.