PHP hit by two unauthenticated RCE bugs, details leaked pre-patch, 1.5M servers exposed
neal_lathia · x · 2026-10-22
A quoted thread details a major PHP security incident: two critical bugs allowing unauthenticated remote code execution, with exploit details leaked before an official patch was available.
The blast radius covers WordPress, MediaWiki, Magento, Joomla, and Laravel; Censys counts 1.5 million servers running versions without a fix. The response escalated to government level — NSA, FBI, CISA, UK agencies and CERT-EU all urged taking systems offline, and Japan's Prime Minister personally posted at 5:55 a.m. advising 48.8 million users to do the same.
More from Safety
- Axios scoop: US banks detect unauthorized AI agents inside customer accounts — daniel_mac8 · 2026-10-22
- Phil Koopman's Keynote: Agentic AI Trust Is Won or Lost at the Edge Cases — DavidLinthicum · 2026-10-22
- Dev reflects on why frontier AI models tripwire cybersecurity prompts — paul_cal · 2026-10-22
- 'Black October': 27 major breaches and CVEs hit in days, from PHP to LiteLLM to GitLab — Confident_Salt_8108 · 2026-10-22
- Vulnerabilities were always there — AI is just better at finding them — jonmarkgo · 2026-10-22
- Security researcher: no AI hacking explosion yet, just a patching explosion — matthew_d_green · 2026-10-22