Post

🚨 The developers of PHP have just released new versions that patch two critical vulnerabilities that could allow remote code execution on any website running PHP (which is virtually all of them). www.php.net/archive/2026...

Eric Geller

@ericjgeller.com

Wiz: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." www.wiz.io/blog/php2she...

wiz.ioPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz BlogCore PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

Eric Geller

@ericjgeller.com

OpenAI, whose model helped researchers discover the vulnerabilities: "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory." openai.com/index/coordi...

openai.comPatch the Planet: global response coordination as agents uncover critical vulnerabilitiesPatch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.

21/10/26, 2:19 pm2 reposts13 likes

Eric Geller

@ericjgeller.com

Today's xkcd: xkcd.com/3314/ Anyone curious about the story behind this comic won't be able to check explain xkcd today, because they took their website down due to the vulnerability: www.explainxkcd.com

Eric Geller

@ericjgeller.com

My initial story on the PHP vulnerabilities: www.cybersecuritydive.com/news/php-web...

cybersecuritydive.comCritical PHP vulnerabilities expose vast majority of websites to potential compromiseThe serious flaws in popular website software prompted government agencies to urge organizations to take their sites offline until they could be fixed.

Eric Geller

@ericjgeller.com

Here, strangely delayed, is CISA's brief advisory about the PHP vulnerabilities: www.cisa.gov/news-events/...

cisa.govCritical Vulnerabilities in PHP Require Immediate Patching | CISA

Eric Geller

@ericjgeller.com

Story updated with more detail, including Cisco's estimate that roughly half of PHP instances are too old to receive the security updates: www.cybersecuritydive.com/news/php-web...

cybersecuritydive.comCritical PHP vulnerabilities expose most websites to potential compromiseGovernment agencies urged organizations to take their sites offline until they could be fixed.

EveningStarNM

@eveningstarnm.bsky.social

They'll need at least a quarter-dozen hours of sleep before then.

💀Ezra🍔

@ezra.solutions

doesn't the comic reference the TLS vulnerability, not the PHP vulnerability? or are those the same vulnerability and I just don't understand the link between the two

Eric Geller

@ericjgeller.com

It definitely could be referencing the TLS vulnerability, I just think the other site being down at the same time is notable!

spooky Deirdre Connolly¹ ² at a distance

@durumcrustulum.com

two independent issues that happen to be breaking back to back (we are all very tired)

bikeyow.bsky.social

@bikeyow.bsky.social

The private key for a intermediate certificate of a Trusted CA was the number 4. The trusted cert is installed on all OSes from smart fridges to server farms. emudhra.we-have-a-problem.com

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise