#php

IEEE Spectrum's Dina Genkina looks at PHP2Shell, the PHP flaw disclosed in late October that put sites running WordPress, Drupal and other PHP software at risk of data theft and remote code execution. The underlying memory bug had been reported to the PHP Foundation in 2024 but was treated as a mere crash. A researcher at the security firm Calif, auditing PHP with AI tools under OpenAI sponsorship, turned it into a working code-execution exploit within two weeks; Wiz confirmed and expanded the findings, and four PHP engineers spent two months on a patch. As far as anyone knows, it was fixed before attackers had the exploit.

"Now it is time for the technical debt to be paid off," says Matt Suiche of Tolmo. Columbia's Suman Jana describes an asymmetry: AI makes finding bugs easier, but fixes must close every path without breaking anything, which strains unfunded open-source maintainers. Johns Hopkins' Matthew Green expects little to change until something worse happens; meanwhile, he says, install updates promptly.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 (out-of-memory handling leaves request data half-initialized) and CVE-2026-109619 (state from a freed request is reused by a later one). The PHP project says every installation serving web requests is at risk, mod_php most of all, and urges an immediate update; it also published minimal backports for PHP 7.4 to 8.1.

The PHP Foundation says the first signs of the memory bug surfaced during a 2024 audit, but work on a fix stalled, which it calls a structural failure. Reports from Calif, OpenAI and Wiz in August made the impact clear. After the CVE IDs leaked on October 20, the release was moved up a day; security firm Calif mistakenly published a demo video, and the Foundation says Chainguard broke the embargo by publishing fixed images hours early.

Three Hacker News threads (the top one 1,549 points) argued over embargoes versus releasing fixes at once, Chainguard's move, and admins racing to patch or shut servers down.