PHP critical RCE bugs leak pre-patch; agencies urge servers offline, 1.5M unpatched
eldonredwards · x · 2026-10-22
- Ethan Mollick amplifies a viral breakdown of a PHP security crisis: two critical unauthenticated RCE bugs whose details leaked before a patch existed, affecting WordPress, MediaWiki, Magento, Joomla and Laravel. Censys counted 1.5 million servers running unfixed versions; NSA, FBI, CISA, the UK and CERT-EU all urged taking systems offline, and Japan's Prime Minister posted at 5:55 AM telling 48.8 million followers the same.
Mollick frames it as a visible sign of what AI insiders have warned about since the Mythos release: attack and defense accelerating at inhuman speeds while the human systems that must respond still move at human pace.
Related event: FBI and NSA Issue Rare Alerts Over Critical PHP RCE Flaws(4 posts)→
More from AGI Musings
- Antivenom Designed in 64 Hours by AI, but Release Still Takes 4-7 Years — burny_tech · 2026-10-22
- A Reddit long-read proposes the Risk and Judgement pattern for bounding agent autonomy — mostly_deterministic · 2026-10-22
- Stephen Wolfram's new work tackles time, consciousness and why the universe exists via computation — burny_tech · 2026-10-22
- Sam Altman calls Anthropic's push to ascribe personhood to models a 'dangerous path' — MatthewBerman · 2026-10-22
- Dev Warns Critical Infrastructure Far More Vulnerable Than PHP Bug Suggests — sull · 2026-10-22
- 'I see no new Google being built': Burkov likens AI token spending to dot-com bubble — burkov · 2026-10-22