Edit: Now that the patches are out, ignore everything below and go update your PHP versions. I've been dealing with this for the last couple hours, here are some useful bits of info: Before I get...
Edit: Now that the patches are out, ignore everything below and go update your PHP versions.
I've been dealing with this for the last couple hours, here are some useful bits of info:
Before I get to anything else: Just shut everything down, there are good reasons to believe this is historic level fucked up. Put up a static file explaining and take the hit.
That said, I looked at the code for the POC that's been circulating and assuming the POC shows the full extent of the problem you can mitigate this without taking sites offline by:
Disabling multipart form handling at the server level. Or if you're behind something like cloudflare, you could do it there instead. This will stop the parser that is believed to be the source of the problem from ever running. It will also disable certain form actions on the site
Or to be extra safe, disabling POST entirely. No one will be able to login or search but the site stays online serving most things.
If you decide to try one of the above, it's key that the actions are disabled before PHP runs, don't try to mitigate this from within PHP.
I chose to take everything offline, in my case I don't have anything running on PHP that's going to lose sales or otherwise be overly expensive. If that wasn't the case, I'd be satisfied that the above mitigations would be a reasonable risk to take but I'd also add defense in depth by limiting what PHP could access and probably putting something between PHP and the database to reject suspicious actions.
Right now it looks like there will be botnets running exploit probes en masse before the patches are out (in 8 hours or so). Probably that's already happening. So take this seriously.
This site has some useful information on how to implement mitigations in various scenarios: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
Security tried to wake me up at 6am to discuss this but they mistakenly associated me with accounts that are not under my purview. Thankfully PHP does not exist in anything I actually manage, with...
Security tried to wake me up at 6am to discuss this but they mistakenly associated me with accounts that are not under my purview. Thankfully PHP does not exist in anything I actually manage, with the exception of a single mailtrap container that is internal and being patched. Though I did have a chuckle when I went to look up some commands for Alpine (I use it for some stuff but rarely) and the Alpine Linux site is offline because of the PHP vulnerability.
The other teams are having a chaotic time though - I don't envy them or anybody else having to deal with this mess.
https://www.php.net/ has the information now. The key information though is only patching is a full fix.
https://www.php.net/ has the information now. The key information though is only patching is a full fix.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities:
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Fun little tidbit: last night in my sleep-deprived state after sending the email to my cousin, I had left a note for my mom saying "internet might be a little broken". According to her,...
Fun little tidbit: last night in my sleep-deprived state after sending the email to my cousin, I had left a note for my mom saying "internet might be a little broken". According to her, surprisingly it didn't come up in the morning news or on NPR this morning. Doesn't seem to be on the national news either.
I guess it's because it didn't grind the world to a halt like the Crowdstrike outage. Still surprising though given the severity.
Interestingly it's been one of the top stories on the BBC since Wednesday evening here. I wonder if mainstream news outlets held off reporting until after the patch was released?
Interestingly it's been one of the top stories on the BBC since Wednesday evening here.
I wonder if mainstream news outlets held off reporting until after the patch was released?
I can only speak for the Netherlands, but it took a few hours for it to hit the news, though it was still roughly 6 hours before the patch got released. It seemed more like people outside of tech,...
I can only speak for the Netherlands, but it took a few hours for it to hit the news, though it was still roughly 6 hours before the patch got released. It seemed more like people outside of tech, understandably, didn't really get how big off a deal it was immediately.
I had a rough day yesterday. My youngest is at university and I’ve had a self hosted (vps self hosted) NextCloud instance for years. Constantly patched. But yesterday I had to shut it down....
I had a rough day yesterday. My youngest is at university and I’ve had a self hosted (vps self hosted) NextCloud instance for years. Constantly patched. But yesterday I had to shut it down. Leaving him with only cached file access to his university work, and stale keepass vault.
But what else to do but hit the off switch? I also lost my keepass vault at that moment. Passkeys and otp all gone. I too had a somewhat stale local copy so that mitigation was sensible.
Then waiting for the nextcloud patches to come out, applying them, testing them, scrubbing through logs for signs of exploitation.
Eventually got my server back online in the small hours in time for today’s lectures.
I’m removing my nextcloud from the public internet over the next couple of weeks, and making it only accessible over my tailnet.
Universal access was convenient no doubt, but that no longer outweighs the benefit of not being public. It probably never did.
PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
[...]
The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.
[...]
Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.
Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.
Preparation steps include identifying who is responsible for managing PHP inside an organization, taking an inventory of every app built on the language, planning a maintenance window starting at 14:00 UTC with contingency plans for earlier, making a backup of site and database files, and monitoring the PHP.net homepage for any late-breaking announcements, including an earlier release time. Some experts suggest unplugging any non-essential systems until they’re patched.
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for...
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for pause:
PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
Considering this would affect WordPress and Mediawiki, as well as anything using "[any] PHP version from PHP 5, released in 2004, onward", I'm assuming this will be causing some serious headaches in the days ahead?
This is basically catastrophic, probably at LEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address...
This is basically catastrophic, probably at about the scale of LEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address bar, free server".
Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt...
Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt before too much damage is done.
Assuming that this impacts you directly - Good luck.
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit. And it sounds like this has already happened, based...
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit.
And it sounds like this has already happened, based on what people are saying on Hacker News.
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is...
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is patching/upgrading. The LLM-located bug there can seemingly easily be mitigated by INI tweaks.
EDIT: A PHP Release Manager has been spotted on Reddit echoing similar sentiments.
We don’t know the full details until later today but this is shaping up to be the worst computer security incident ever. A lot of sites have shut down until the patch releases in preparation.
We don’t know the full details until later today but this is shaping up to be the worst computer security incident ever. A lot of sites have shut down until the patch releases in preparation.
Oh yea, this is all hands on deck end of the world type stuff. Consider that a lot of shops still running PHP are doing so because they behind, they've been unable to keep up with current tech,...
Oh yea, this is all hands on deck end of the world type stuff.
Consider that a lot of shops still running PHP are doing so because they behind, they've been unable to keep up with current tech, they probably have b-level developers because of both their culture (saltwater pool, brain drain, etc) and because of pay (tech isn't their main product, IT gets shafted in the budget)
You got these idiots tryna figure out what to even do, you've got MAYBE 1 decent devops guy/developer who's been pushed into a devops role who actually knows whats going on and what to do and no one listens like always
Pretty much all these companies are gonna just have to go dark, regardless of what their actual options are. We're talking like, mortgage companies, banks, disability resources, non for profits, etc etc. Basically everyone except actual tech companies.
Thats fair, Ive only ever worked at US companies, and thats how it is here. It got to the point where last time I was job hunting I avoided any company that asked for php skills. Not that I don’t...
Thats fair, Ive only ever worked at US companies, and thats how it is here.
It got to the point where last time I was job hunting I avoided any company that asked for php skills. Not that I don’t like php, it’s that the companies that use it here suck
I am so glad to not be working with PHP at all right now. It may still affect me, but this is the worst kind of news to wake up to. To anyone dealing with this, all the strength. Holy shit this is...
I am so glad to not be working with PHP at all right now. It may still affect me, but this is the worst kind of news to wake up to.
To anyone dealing with this, all the strength. Holy shit this is catastrophic.
...Well. Tomorrow will be interesting to see the fallout of this. Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's...
...Well.
Tomorrow will be interesting to see the fallout of this.
Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's senior day center business using Wordpress, and am trying to figure out if I should try to get in and temporarily shut it down. As far as I remember, the only information it collects should be the contact form for people's names, emails and phone numbers (and last I checked, most of the responses are honestly bots). So not sure how urgent/serious that one is.
If I do shut it down, I'm also not sure how to best go about that because A) brain fuzzy, and B) I've never had to shut down a site. Made more complicated by the fact that I don't know if I can access the actual web host (Bluehost). Last I remember it requires 2FA from my cousin's email or phone. I still have admin access to the WP panel at least, but if I have to do it from Bluehost itself I can't do much right now.
(...And writing that just made me realize that Bluehost itself may also be vulnerable. And I am definitely not clear-headed enough to... Contemplate and search into the potential ramifications of that...?? I can't even come up with words. Of all the days to be horrifically sleep deprived...)
So I humbly ask you, lovely people of Tildes who are both more awake and more experienced: should I shut it down, and if yes, what's the best way to take a Wordpress site offline in this case?
back to googling "does [insert every site I use] use PHP" to see how many of them night be down or on fire tomorrow
If a PHP dev is saying turning off a server would be sensible... I wish I could help you with the how since it looks like you're in a pickle but if you can figure it out you probably should. Edit:...
Well, my brain has woken enough that your comment let me know to google "can you turn off server from Wordpress admin panel". And after some tweaks to that, because it keels recommending plugins...
Well, my brain has woken enough that your comment let me know to google "can you turn off server from Wordpress admin panel". And after some tweaks to that, because it keels recommending plugins for maintenance mode (which I don't think will help in this case)...
Google's AI says I'd need to use Cpanel. Which is on Bluehost. Which I cannot access at 2:3p am because my cousin is asleep and has the 2FA info. Never a problem until tonight since I could do whatever little help she needed from the Wordpress dashboard.
It also said something about blocking PHP access to .htaccess and/or folders. And... Any other night, I could go down that rabbit hole and figure it out at 2:30 am because I'm basically nocturnal and don't get tired until like 3 or 4. But tonight, my brain is definitely not up to the task and is already flagging again while writing this comment. Definitely not good enough to risk messing with the site that deeply right now without a solid guide on how to mitigate damage right now.
I think I'm resigned to not being able to shut down the site tonight. I'm hoping the fact it's for a small-town day center for people with dementia means it's not exactly disastrous. The site is just for people to get info and contact her, so at most they should just get names, emails, phone numbers and the fact that Bob Personman is the Caretaker of Alice Oldwoman, and is reaching out to ask about tours and would prefer to be contacted by email.
(Honestly more concerned about Bluehost itself being potentially vulnerable. The only financial and serious personal info of any sort that should be tied to this site should be my cousin's billing information on there.)
That said: if anyone can tell me a concrete method to specifically minimize damage from within the Wordpress dashboard, I'll do it. Unfortunately, I do need some specific actions specific to working with Wordpress, because my brain is in a state where I can't fully "translate"... Or maybe "parse"...? general terminology, to figure out what to do. (Can't even think of fitting words...)
At this rate I'll probably only be awake for another hour at best before I crash for good. Only reason I'm even awake right now is probably because I'm waiting for my sleeping mask to dry after desperately washing it a few hours ago.
Can you access the filesystem without going through cpanel? FTP, SSH, etc..? If so add this to your .htaccess file if the server is running apache: <If "%{HTTP:Content-Type} =~ /multipart/i">...
Can you access the filesystem without going through cpanel? FTP, SSH, etc..?
If so add this to your .htaccess file if the server is running apache:
<If "%{HTTP:Content-Type} =~ /multipart/i">
Require all denied
</If>
Unfortunately, don't think so. Fairly sure that it got all transferred to Cpanel directly once I uploaded it. Used Duplicator or some similar back-up plugin to migrate it.
Unfortunately, don't think so. Fairly sure that it got all transferred to Cpanel directly once I uploaded it. Used Duplicator or some similar back-up plugin to migrate it.
Next best advice, short of waking your cousin up which... hard to predict the future but it might be worth it. If not, then have them shut the site off when they wake up and wait for the patches...
Next best advice, short of waking your cousin up which... hard to predict the future but it might be worth it. If not, then have them shut the site off when they wake up and wait for the patches to be available.
And sleep well! It sounds like the worst case with that site probably isn't worth losing any more sleep
Well, guess I'll back it up then. Thankfully it still has Duplicator installed, so already got that done and downloaded. Not sure she'd be able to figure out how to shut off the site herself...
Well, guess I'll back it up then. Thankfully it still has Duplicator installed, so already got that done and downloaded. Not sure she'd be able to figure out how to shut off the site herself though unfortunately. May need to shoot her an email.
For now, I also remembered I still have another site on Dreamhost that I used for my capstone in college. That one I'm considerably less concerned with since A) there's no user information whatsoever, besides B) the "staging/prototype site" I used until we got her domain and hosting set up (started out on it locally, but it became more convenient to let her see updates while still designing the site). That one though, I CAN easily access and edit the .htaccess file.
If it breaks and goes down permanently... honestly, oh well? It was my capstone project and just used to host some comic pages and a text-based branching narrative made with Ink. If I don't still have the existing files somewhere, I should be able to rebuild it fairly easily. or maybe just finally take it offline, genuinely forget it exists most of the time
Edit: Renamed the wordpress folder to just "[Cousin]SiteBREAKTIME". Seemed quicker, and now gives a Wordpress "page not found" error page. Might just do it to the root folder for my whole site to be safe. Or maybe just the .php folder?? Research required.
Edit 2: Personal site is now fully on break time. Yay. Gonna see if I can find clear instructions to email my cousin. My brain is coming back online enough I might be able to accomplish that. Problem is accessing and navigating the Cpanel may be beyond her ability, and I don't know the Bluehost interface off the top of my head to give her tips on how to specifically navigate it...
Welp can confirm, exploited in the wild because some PHP sites I host got hit. Fortunately super low impact, already cleaned up, but the speed of spread is crazy.
Welp can confirm, exploited in the wild because some PHP sites I host got hit. Fortunately super low impact, already cleaned up, but the speed of spread is crazy.
This was in my logs, "POST / HTTP/1.1" 200 38463 "-" "Mozilla/5.0 php2shell-sidfix" and they dropped a backdoor script at the same time. Not even bothering to even vaguely hide what they're doing.
The age of LLMs means that the moment a proof of concept became public, anyone could have a custom made tool to attack any PHP site to do whatever they want.
The age of LLMs means that the moment a proof of concept became public, anyone could have a custom made tool to attack any PHP site to do whatever they want.
So, if I don't maintain any software made with PHP, is there anything that normal web users need to do regarding this? Should I not be web browsing at all? Do I need to make sure I have a certain...
So, if I don't maintain any software made with PHP, is there anything that normal web users need to do regarding this? Should I not be web browsing at all? Do I need to make sure I have a certain update on my OS or browser? Anything like that?
You should assume that any data on any site powered by PHP may be leaked. If you share passwords, should reset them. If one of them, for whatever reason, had your SSN, should freeze your credit....
You should assume that any data on any site powered by PHP may be leaked. If you share passwords, should reset them. If one of them, for whatever reason, had your SSN, should freeze your credit. That kind of thing.
And yep, these bugs were found via AI. From the Wiz blog: ... ... And if they didn't find it, apparently someone else would have? From OpenAI's blog: (Calif is apparently a security firm.)
In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The issues described below all stem from key architecture decisions, some made over a decade ago, and were grouped under two CVEs, with severity reaching CVSS 9.2. The work grew into a cross-industry effort to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure.
...
We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities. Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging. Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.
...
We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
And if they didn't find it, apparently someone else would have? From OpenAI's blog:
Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities
No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
https://fedi.katze.sh/@elise/117479383739450605 The patch may be incomplete. I'm not knowledgeable enough to verify this Edit: also https://x.com/Dinosn/status/2112962329772245311/photo/1
It looks like the patch is fine, these appear to be separate vulnerabilities. It also looks like they require specific circumstances so they're unlikely to be widely exploitable if they turn out...
It looks like the patch is fine, these appear to be separate vulnerabilities. It also looks like they require specific circumstances so they're unlikely to be widely exploitable if they turn out to be legitimate.
Who knows though, not enough info to be sure in either case.
With everyone having access to LLMs, having apparently no ethics about disclosure, and excited about being a part of the buzz... it's going to be a wild few days.
There could definitely be more vulnerabilities to worry about, but expect a ton of misinformation.
Edit: Now that the patches are out, ignore everything below and go update your PHP versions.
I've been dealing with this for the last couple hours, here are some useful bits of info:
Before I get to anything else: Just shut everything down, there are good reasons to believe this is historic level fucked up. Put up a static file explaining and take the hit.
That said, I looked at the code for the POC that's been circulating and assuming the POC shows the full extent of the problem you can mitigate this without taking sites offline by:
If you decide to try one of the above, it's key that the actions are disabled before PHP runs, don't try to mitigate this from within PHP.
I chose to take everything offline, in my case I don't have anything running on PHP that's going to lose sales or otherwise be overly expensive. If that wasn't the case, I'd be satisfied that the above mitigations would be a reasonable risk to take but I'd also add defense in depth by limiting what PHP could access and probably putting something between PHP and the database to reject suspicious actions.
Right now it looks like there will be botnets running exploit probes en masse before the patches are out (in 8 hours or so). Probably that's already happening. So take this seriously.
This site has some useful information on how to implement mitigations in various scenarios:
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
For any people maintaining PHP systems that talk to external services over HTTPS, I’m so, so, sorry.
If this is a 9.2 out of 10, what's a 10?
An RCE, but in a real programming language.
Apparently GitLab just had their own RCE vuln with a CVSS of 10 at the same time! https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee
Security tried to wake me up at 6am to discuss this but they mistakenly associated me with accounts that are not under my purview. Thankfully PHP does not exist in anything I actually manage, with the exception of a single mailtrap container that is internal and being patched. Though I did have a chuckle when I went to look up some commands for Alpine (I use it for some stuff but rarely) and the Alpine Linux site is offline because of the PHP vulnerability.
The other teams are having a chaotic time though - I don't envy them or anybody else having to deal with this mess.
Yeah unlike all hands for let's say Crowdstrike, this is relatively easy going for techies if they're not touching anything PHP.
According to discussion on Hacker News, it is already being exploited.
https://www.php.net/ has the information now. The key information though is only patching is a full fix.
Fun little tidbit: last night in my sleep-deprived state after sending the email to my cousin, I had left a note for my mom saying "internet might be a little broken". According to her, surprisingly it didn't come up in the morning news or on NPR this morning. Doesn't seem to be on the national news either.
I guess it's because it didn't grind the world to a halt like the Crowdstrike outage. Still surprising though given the severity.
Interestingly it's been one of the top stories on the BBC since Wednesday evening here.
I wonder if mainstream news outlets held off reporting until after the patch was released?
I can only speak for the Netherlands, but it took a few hours for it to hit the news, though it was still roughly 6 hours before the patch got released. It seemed more like people outside of tech, understandably, didn't really get how big off a deal it was immediately.
I had a rough day yesterday. My youngest is at university and I’ve had a self hosted (vps self hosted) NextCloud instance for years. Constantly patched. But yesterday I had to shut it down. Leaving him with only cached file access to his university work, and stale keepass vault.
But what else to do but hit the off switch? I also lost my keepass vault at that moment. Passkeys and otp all gone. I too had a somewhat stale local copy so that mitigation was sensible.
Then waiting for the nextcloud patches to come out, applying them, testing them, scrubbing through logs for signs of exploitation.
Eventually got my server back online in the small hours in time for today’s lectures.
I’m removing my nextcloud from the public internet over the next couple of weeks, and making it only accessible over my tailnet.
Universal access was convenient no doubt, but that no longer outweighs the benefit of not being public. It probably never did.
From the article:
[...]
[...]
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for pause:
Considering this would affect WordPress and Mediawiki, as well as anything using "[any] PHP version from PHP 5, released in 2004, onward", I'm assuming this will be causing some serious headaches in the days ahead?
This is basically catastrophic, probably at
about the scale ofLEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address bar, free server".Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt before too much damage is done.
Assuming that this impacts you directly - Good luck.
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit.
And it sounds like this has already happened, based on what people are saying on Hacker News.
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is patching/upgrading. The LLM-located bug there can seemingly easily be mitigated by INI tweaks.
EDIT: A PHP Release Manager has been spotted on Reddit echoing similar sentiments.
We don’t know the full details until later today but this is shaping up to be the worst computer security incident ever. A lot of sites have shut down until the patch releases in preparation.
Oh yea, this is all hands on deck end of the world type stuff.
Consider that a lot of shops still running PHP are doing so because they behind, they've been unable to keep up with current tech, they probably have b-level developers because of both their culture (saltwater pool, brain drain, etc) and because of pay (tech isn't their main product, IT gets shafted in the budget)
You got these idiots tryna figure out what to even do, you've got MAYBE 1 decent devops guy/developer who's been pushed into a devops role who actually knows whats going on and what to do and no one listens like always
Pretty much all these companies are gonna just have to go dark, regardless of what their actual options are. We're talking like, mortgage companies, banks, disability resources, non for profits, etc etc. Basically everyone except actual tech companies.
PHP is still surprisingly popular and normal, especially outside of America.
Thats fair, Ive only ever worked at US companies, and thats how it is here.
It got to the point where last time I was job hunting I avoided any company that asked for php skills. Not that I don’t like php, it’s that the companies that use it here suck
Same when they mention Jira. Unless you like that kind of micromanaging/turf war nonsense, then you'll have a great time.
As far as I can tell my Nextcloud server hadn't been hit yet, but it's been shut off for now. I'm suddenly really glad I did my pre-bed tildes scroll.
I am so glad to not be working with PHP at all right now. It may still affect me, but this is the worst kind of news to wake up to.
To anyone dealing with this, all the strength. Holy shit this is catastrophic.
...Well.
Tomorrow will be interesting to see the fallout of this.
Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's senior day center business using Wordpress, and am trying to figure out if I should try to get in and temporarily shut it down. As far as I remember, the only information it collects should be the contact form for people's names, emails and phone numbers (and last I checked, most of the responses are honestly bots). So not sure how urgent/serious that one is.
If I do shut it down, I'm also not sure how to best go about that because A) brain fuzzy, and B) I've never had to shut down a site. Made more complicated by the fact that I don't know if I can access the actual web host (Bluehost). Last I remember it requires 2FA from my cousin's email or phone. I still have admin access to the WP panel at least, but if I have to do it from Bluehost itself I can't do much right now.
(...And writing that just made me realize that Bluehost itself may also be vulnerable. And I am definitely not clear-headed enough to... Contemplate and search into the potential ramifications of that...?? I can't even come up with words. Of all the days to be horrifically sleep deprived...)
So I humbly ask you, lovely people of Tildes who are both more awake and more experienced: should I shut it down, and if yes, what's the best way to take a Wordpress site offline in this case?
back to googling "does [insert every site I use] use PHP" to see how many of them night be down or on fire tomorrow
If a PHP dev is saying turning off a server would be sensible...
I wish I could help you with the how since it looks like you're in a pickle but if you can figure it out you probably should.
Edit: Ironically, with the right know-how you could probably use the POC of the exploit to send a shutdown command to the server
Well, my brain has woken enough that your comment let me know to google "can you turn off server from Wordpress admin panel". And after some tweaks to that, because it keels recommending plugins for maintenance mode (which I don't think will help in this case)...
Google's AI says I'd need to use Cpanel. Which is on Bluehost. Which I cannot access at 2:3p am because my cousin is asleep and has the 2FA info. Never a problem until tonight since I could do whatever little help she needed from the Wordpress dashboard.
It also said something about blocking PHP access to .htaccess and/or folders. And... Any other night, I could go down that rabbit hole and figure it out at 2:30 am because I'm basically nocturnal and don't get tired until like 3 or 4. But tonight, my brain is definitely not up to the task and is already flagging again while writing this comment. Definitely not good enough to risk messing with the site that deeply right now without a solid guide on how to mitigate damage right now.
I think I'm resigned to not being able to shut down the site tonight. I'm hoping the fact it's for a small-town day center for people with dementia means it's not exactly disastrous. The site is just for people to get info and contact her, so at most they should just get names, emails, phone numbers and the fact that Bob Personman is the Caretaker of Alice Oldwoman, and is reaching out to ask about tours and would prefer to be contacted by email.
(Honestly more concerned about Bluehost itself being potentially vulnerable. The only financial and serious personal info of any sort that should be tied to this site should be my cousin's billing information on there.)
That said: if anyone can tell me a concrete method to specifically minimize damage from within the Wordpress dashboard, I'll do it. Unfortunately, I do need some specific actions specific to working with Wordpress, because my brain is in a state where I can't fully "translate"... Or maybe "parse"...? general terminology, to figure out what to do. (Can't even think of fitting words...)
At this rate I'll probably only be awake for another hour at best before I crash for good. Only reason I'm even awake right now is probably because I'm waiting for my sleeping mask to dry after desperately washing it a few hours ago.
Can you access the filesystem without going through cpanel? FTP, SSH, etc..?
If so add this to your .htaccess file if the server is running apache:
Unfortunately, don't think so. Fairly sure that it got all transferred to Cpanel directly once I uploaded it. Used Duplicator or some similar back-up plugin to migrate it.
Next best advice, short of waking your cousin up which... hard to predict the future but it might be worth it. If not, then have them shut the site off when they wake up and wait for the patches to be available.
And sleep well! It sounds like the worst case with that site probably isn't worth losing any more sleep
Well, guess I'll back it up then. Thankfully it still has Duplicator installed, so already got that done and downloaded. Not sure she'd be able to figure out how to shut off the site herself though unfortunately. May need to shoot her an email.
For now, I also remembered I still have another site on Dreamhost that I used for my capstone in college. That one I'm considerably less concerned with since A) there's no user information whatsoever, besides B) the "staging/prototype site" I used until we got her domain and hosting set up (started out on it locally, but it became more convenient to let her see updates while still designing the site). That one though, I CAN easily access and edit the .htaccess file.
If it breaks and goes down permanently... honestly, oh well? It was my capstone project and just used to host some comic pages and a text-based branching narrative made with Ink. If I don't still have the existing files somewhere, I should be able to rebuild it fairly easily.
or maybe just finally take it offline, genuinely forget it exists most of the timeEdit: Renamed the wordpress folder to just "[Cousin]SiteBREAKTIME". Seemed quicker, and now gives a Wordpress "page not found" error page. Might just do it to the root folder for my whole site to be safe. Or maybe just the .php folder?? Research required.
Edit 2: Personal site is now fully on break time. Yay. Gonna see if I can find clear instructions to email my cousin. My brain is coming back online enough I might be able to accomplish that. Problem is accessing and navigating the Cpanel may be beyond her ability, and I don't know the Bluehost interface off the top of my head to give her tips on how to specifically navigate it...
If you can, start a download of a full backup before you crash
Welp can confirm, exploited in the wild because some PHP sites I host got hit. Fortunately super low impact, already cleaned up, but the speed of spread is crazy.
Out of curiosity, what did "getting hit" look like for you? Last night/this morning my main concern was scraping the databases for information.
This was in my logs,
"POST / HTTP/1.1" 200 38463 "-" "Mozilla/5.0 php2shell-sidfix"
and they dropped a backdoor script at the same time. Not even bothering to even vaguely hide what they're doing.
The age of LLMs means that the moment a proof of concept became public, anyone could have a custom made tool to attack any PHP site to do whatever they want.
So, if I don't maintain any software made with PHP, is there anything that normal web users need to do regarding this? Should I not be web browsing at all? Do I need to make sure I have a certain update on my OS or browser? Anything like that?
You should assume that any data on any site powered by PHP may be leaked. If you share passwords, should reset them. If one of them, for whatever reason, had your SSN, should freeze your credit. That kind of thing.
Make sure you have no shared passwords. Some sites will be hacked over this.
Today was absolutely wild with regards to IT security. First the CA certificates, then PHP, all withing 24 hours.. :S
And yep, these bugs were found via AI.
From the Wiz blog:
...
...
And if they didn't find it, apparently someone else would have? From OpenAI's blog:
(Calif is apparently a security firm.)
Here is Calif’s page on the bug:
https://fedi.katze.sh/@elise/117479383739450605
The patch may be incomplete. I'm not knowledgeable enough to verify this
Edit: also https://x.com/Dinosn/status/2112962329772245311/photo/1
It looks like the patch is fine, these appear to be separate vulnerabilities. It also looks like they require specific circumstances so they're unlikely to be widely exploitable if they turn out to be legitimate.
Who knows though, not enough info to be sure in either case.
With everyone having access to LLMs, having apparently no ethics about disclosure, and excited about being a part of the buzz... it's going to be a wild few days.
There could definitely be more vulnerabilities to worry about, but expect a ton of misinformation.