For everyone wondering why the patch is not out yet:<p>There are a handful people responsible for doing a release. They are still asleep.<p>To be honest, I am also shocked, that the exploit was published <i>that</i> quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...
Hopefully the industry will learn something about how withholding fixes to known vulnerabilities is, in fact, bad policy.
The police should wake them up.
lmfao what... If the police woke me up to fix <i>anything</i> the only thing they'd get out of me is "lawyer". And I wouldn't put a single iota of effort into fixing that thing until the entire matter with the police was resolved. If you want someone's attention on something, especially something nuanced and intricate like a software bug, that's absolutely not how you get it.
In March this year, German police set out to warn admins on a weekend.<p>German article: <a href="https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-wegen-Zero-Day-aus-11221345.html" rel="nofollow">https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-w...</a>
It could be just a friendly phone call to wake you up and read the news. Doesn't mean they are forcing you to do anything.
I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
The exploit is already out. Yeah this looks like it's going to go on history as the worst vulnerability ever. And now with LLMs you'll likely see tens of thousands of agents hacking any php website out there within hours.
Yup, I'm seeing several legit people on X claiming to have seen or found the exploit. Some say that: turning session.upload_progress.enabled off and setting file_uploads = Off will mitigate. But others are claiming that those steps are not enough and "Upload progress can serialize before basic RINT clears BG(serialize)". So, I'm taking no chances and taking my services offline.<p><a href="https://x.com/MagicalTux/status/2112725774025572431" rel="nofollow">https://x.com/MagicalTux/status/2112725774025572431</a>
<a href="https://x.com/rina4_tot/status/2112723421641531772" rel="nofollow">https://x.com/rina4_tot/status/2112723421641531772</a><p>I think this exploit + agentic AI (which allows for rapid secret exfiltration/utilization) may be a potent enough combo to trigger a sort of Kessler Syndrome for network security.
If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.
The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.<p>I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
<a href="https://x.com/k_firsov/status/2112641845926989944" rel="nofollow">https://x.com/k_firsov/status/2112641845926989944</a>
The URL is to show the effects of the exploit. The person's running a python script that runs the exploit and then makes the PHP installation execute an arbitrary shell command. The proof of concept involves writing "pwned" to a publicly accessible location on the web server, then they refresh the browser pointing at the URL to show it's been written.
This is gonna rinse so many LAMP WordPress installs where the PHP version is either not getting a patch or the hosting is managed by the user via a contractor or the hosting is managed by a company with a fleet of custom servers etc etc.
I can think of some really ancient phpBB boards that probably won't ever come back if they get hit.
We almost need some bot that logs in to every vulnerable PHP server and turns it off to prevent it being properly exploited before the server admin updates it..
If people wait too long you could even have the bot use the exploit to update the PHP version.
Kindware instead of malware. Just goes around finding vulnerabilities and using them to patch things and improve security everywhere.
I’ve thought about doing this in the past but have no trust in police to see it as a Good Samaritan act
A user on X claims:<p><pre><code> Temporaly mitigation
php.ini: session.upload_progress.enabled = Off
</code></pre>
<a href="https://x.com/k_firsov/status/2112718728232329240#m" rel="nofollow">https://x.com/k_firsov/status/2112718728232329240#m</a><p><a href="https://xitter.cf/k_firsov/status/2112718728232329240#m" rel="nofollow">https://xitter.cf/k_firsov/status/2112718728232329240#m</a>
Just shut down our MediaWiki site temporarily out of an abundance of caution. The twitter videos look scary...
Once the dust has settled, it would be interesting to give LLMs the pre-patch source code and see whether any of them can identify this chain of vulnerabilities. Even if they can't identify the full chain, can they at least spot one of the constituent bugs and recognise its seriousness?<p>If they can't, why not?<p>If they can, why haven't they already?
That is definitely very not good.<p>I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building<p>but this time it's php directly? that's scary
There are regular security patches for basically everything these days, including OSs. Why does this notice stand out to you? The post suggests that they're being proactive, and discovered and patched these before they were exploited. Rather they take this transparent approach, as opposed to being silent and/or doing nothing.
This might be the nail in the coffin for php.
Given the proven capabilities of LLMs in computer security, get ready for similar issues to affect NodeJS, Java, Go, Rust etc...
This is a joke, right? I can't tell if this is a joke.
Don’t you mean WWZ ? Php is hardly dead – billions of installs.
“PHP is the cockroach of the internet”
There is allegedly a temporary mitigation: <a href="https://twitter.com/k_firsov/status/2112718728232329240" rel="nofollow">https://twitter.com/k_firsov/status/2112718728232329240</a><p>php.ini:<p><pre><code> session.upload_progress.enabled = Off</code></pre>
According to a PHP core dev, this is insufficient, but no details were provided. Probably can't hurt anyway.<p><a href="https://phpc.social/@Girgias/117476477429221001" rel="nofollow">https://phpc.social/@Girgias/117476477429221001</a>
Just a heads up, as of my comment, this is not endorsed by PHP as a migration for the patch.
The PoC says so.
> as of my comment, this is not endorsed by PHP<p>Are you speaking officially here?<p>There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?
I am not affiliated with PHP in any way or sense, I am saying this as someone who is able to see PHP's announcements, and there was no patch or mitigation announced by PHP.<p>I don't think pulling mitigations from random users online during a developing situation is a good idea. I think shutting down ones PHP services for the time being is a very good idea if that's an option.
"LB"?
I wouldn't skip updating, but is there anything else we can do, other than simply shutting down the web server until the fix is available?
I do not have details about any mitigation. There are rumors that people have independently come across php2shell exploits.<p>I shut down my servers five hours ago. This might have seemed premature at the time.<p>I think the best course of advice for most people is to shut down their servers as soon as they possibly can.
I applied the mitigation to all my servers when it was released, but now I've stopped all the httpds. A few hours of overnight downtime, vs potentially trying to restore everything from backups tomorrow. Everyone should weigh it up.
You could disconnect the web server from the internet!
Uh oh, POC is already out there
<a href="https://jackalsyn.com/posts/php-up-2026.html" rel="nofollow">https://jackalsyn.com/posts/php-up-2026.html</a>
They need to release it now.
A lot of people are going to be up late on account of this.
Only 53 comments for what's most likely going to be the biggest vulnerability in history? I don't understand how this isn't getting more attention. The exploit is already out and it's basically shell access on any php website out there.
It's also very early in EU and evening/night time in part of US. The information that was out earlier was on level "make sure you update tomorrow when the patch comes out", the actual details weren't out yet.
We're all busy turning off uploads on our servers
Strange to see this so far down the front page. If the rumors are true, it may be worse than Log4Shell.
No hints as to what versions are affected?
> These vulnerabilities could affect all PHP versions from PHP 5 onwards<p><a href="https://cert.europa.eu/publications/security-advisories/2026-018/" rel="nofollow">https://cert.europa.eu/publications/security-advisories/2026...</a><p>> affect PHP versions 5, 6, 7, and 8.<p><a href="https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/" rel="nofollow">https://www.bleepingcomputer.com/news/security/php-warns-adm...</a> (which references HN as a source - <a href="https://news.ycombinator.com/item?id=50167754">https://news.ycombinator.com/item?id=50167754</a>)
How is the patch still not out yet? This is another case of big tech players all colluding together leaving all the small guys out to dry.<p>At least this time we can have LLMs rediscover it and make patches ourselves.
I am seeing a lot of words like "unconditional" thrown around but I remind that defense in depth <i>is</i> a thing and you can practice it, or should have been practicing it. You can, for example, disable the `system` function of PHP altogether. You can also arrange for your PHP to be running in a situation where there's no shell, or any other program, to exec. Or for that matter a filesystem.
It's a RCE bug, it does not matter if you disable php functions. It's not arbitrary PHP execution, it's an exploit chain resulting in arbitrary code execution.
Indeed, an attacker theoretically can access anything the PHP process has permission to access. However even without limiting permissions (also a good idea) that means the simple/published exploits won't work on your server, and there's a high chance criminals will look for other targets, assuming you're not targeted.
You know how "resulting in a shell" works?
no idea why this is downvoted. PHP runs typically on linux machines. If you depend on a language feature to prevent 'exploit' and don't utilize the operating systems features to limit access to data.<p>Shell access is not good, but in many places that wouldn't be the end of the world either.<p>Rethink your strategy
If your PHP application accesses a database, you've got exfiltration, it doesn't matter in this case. Unless your PHP application is just echoing non sensitive data (i.e. rendering md files)...
<a href="https://x.com/J4ck3LSyN/status/2112703096443097263" rel="nofollow">https://x.com/J4ck3LSyN/status/2112703096443097263</a> Already being exploited. They need to release the patch now, not later. This is already being deployed by attackers as we speak.
Some more discussion: <a href="https://news.ycombinator.com/item?id=50171528">https://news.ycombinator.com/item?id=50171528</a>
PHP is truly a garbage ecosystem. I thought log4shell was bad but this is 100X worse.<p>With vibe coded slop tools readily available, using php in 2026 is just laziness.