PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
[...]
The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.
[...]
Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.
Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.
Preparation steps include identifying who is responsible for managing PHP inside an organization, taking an inventory of every app built on the language, planning a maintenance window starting at 14:00 UTC with contingency plans for earlier, making a backup of site and database files, and monitoring the PHP.net homepage for any late-breaking announcements, including an earlier release time. Some experts suggest unplugging any non-essential systems until they’re patched.
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for...
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for pause:
PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.
Considering this would affect WordPress and Mediawiki, as well as anything using "[any] PHP version from PHP 5, released in 2004, onward", I'm assuming this will be causing some serious headaches in the days ahead?
This is basically catastrophic, probably at LEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address...
This is basically catastrophic, probably at about the scale of LEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address bar, free server".
Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt...
Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt before too much damage is done.
Assuming that this impacts you directly - Good luck.
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit. And it sounds like this has already happened, based...
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit.
And it sounds like this has already happened, based on what people are saying on Hacker News.
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is...
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is patching/upgrading. The LLM-located bug there can seemingly easily be mitigated by INI tweaks.
EDIT: A PHP Release Manager has been spotted on Reddit echoing similar sentiments.
...Well. Tomorrow will be interesting to see the fallout of this. Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's...
...Well.
Tomorrow will be interesting to see the fallout of this.
Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's senior day center business using Wordpress, and am trying to figure out if I should try to get in and temporarily shut it down. As far as I remember, the only information it collects should be the contact form for people's names, emails and phone numbers (and last I checked, most of the responses are honestly bots). So not sure how urgent/serious that one is.
If I do shut it down, I'm also not sure how to best go about that because A) brain fuzzy, and B) I've never had to shut down a site. Made more complicated by the fact that I don't know if I can access the actual web host (Bluehost). Last I remember it requires 2FA from my cousin's email or phone. I still have admin access to the WP panel at least, but if I have to do it from Bluehost itself I can't do much right now.
(...And writing that just made me realize that Bluehost itself may also be vulnerable. And I am definitely not clear-headed enough to... Contemplate and search into the potential ramifications of that...?? I can't even come up with words. Of all the days to be horrifically sleep deprived...)
So I humbly ask you, lovely people of Tildes who are both more awake and more experienced: should I shut it down, and if yes, what's the best way to take a Wordpress site offline in this case?
back to googling "does [insert every site I use] use PHP" to see how many of them night be down or on fire tomorrow
From the article:
[...]
[...]
According to discussion on Hacker News, it is already being exploited.
As someone with only a cursory understanding of IT vulnerabilities and no industry experience whatsoever, how does this compare with other recent exploits? The below quote gave me a moment for pause:
Considering this would affect WordPress and Mediawiki, as well as anything using "[any] PHP version from PHP 5, released in 2004, onward", I'm assuming this will be causing some serious headaches in the days ahead?
This is basically catastrophic, probably at
about the scale ofLEVELS EXCEEDING Heartbleed or Shellshock from like a decade ago. From my circles, it seems to be as easy as basically "paste something into the address bar, free server".Considering that neither of those exploits were subject to LLM agents, that's quite terrifying. Here's hoping that some of the slower moving systems (government, community, etc) are quick to adapt before too much damage is done.
Assuming that this impacts you directly - Good luck.
Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit.
And it sounds like this has already happened, based on what people are saying on Hacker News.
Rumors are swirling, we'll only know for sure once it officially releases. But a PHP core dev was spotted on Mastodon saying in response to those rumors that the only mitigation is patching/upgrading. The LLM-located bug there can seemingly easily be mitigated by INI tweaks.
EDIT: A PHP Release Manager has been spotted on Reddit echoing similar sentiments.
As far as I can tell my Nextcloud server hadn't been hit yet, but it's been shut off for now. I'm suddenly really glad I did my pre-bed tildes scroll.
...Well.
Tomorrow will be interesting to see the fallout of this.
Currently it's 12:30 am and I'm operating on less than 4 hours of sleep, so brain is a bit fuzzy. I made a website for my cousin's senior day center business using Wordpress, and am trying to figure out if I should try to get in and temporarily shut it down. As far as I remember, the only information it collects should be the contact form for people's names, emails and phone numbers (and last I checked, most of the responses are honestly bots). So not sure how urgent/serious that one is.
If I do shut it down, I'm also not sure how to best go about that because A) brain fuzzy, and B) I've never had to shut down a site. Made more complicated by the fact that I don't know if I can access the actual web host (Bluehost). Last I remember it requires 2FA from my cousin's email or phone. I still have admin access to the WP panel at least, but if I have to do it from Bluehost itself I can't do much right now.
(...And writing that just made me realize that Bluehost itself may also be vulnerable. And I am definitely not clear-headed enough to... Contemplate and search into the potential ramifications of that...?? I can't even come up with words. Of all the days to be horrifically sleep deprived...)
So I humbly ask you, lovely people of Tildes who are both more awake and more experienced: should I shut it down, and if yes, what's the best way to take a Wordpress site offline in this case?
back to googling "does [insert every site I use] use PHP" to see how many of them night be down or on fire tomorrow