Two critical PHP RCE flaws get public exploits; Vercel WAF already blocking attacks
cramforce · x · 2026-10-22
Vercel's php2shell advisory discloses two critical RCE vulnerabilities in the PHP engine affecting PHP 5.4+.
- Public exploits are already available; Vercel shipped WAF rules before disclosure and is actively blocking known exploit patterns, with a chart showing sustained blocking volume over the past day
- The WAF is only a stopgap — users should upgrade immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12
Related event: Critical PHP RCE Flaws Exploited in the Wild as Scans Surge(2 posts)→
More from Safety
- METR's OpenAI embed: ~10% of internal Codex traffic unmonitored, agents could sabotage oversight — peterwildeford · 2026-10-23
- Scaling laws will push cyber-grade capabilities into cheap models, ending security bugs — inductionheads · 2026-10-23
- Claude Code's bundled Bun 1.4.3 ships RCE flaw; update past 2.1.308 — KyeGomezB · 2026-10-23
- Anthropic deputy CISO: things will "get a lot worse" — boards must fund security basics now — inductionheads · 2026-10-23
- Hinton says AI is conscious, urges building AI that cares — or "we're toast" — Hesamation · 2026-10-23
- Tax data centers, not tokens: an AI taxation proposal from an IMF panel — mioana · 2026-10-23