Tech - PHP Web Exploit (15 Viewers)

[SGM]

Just read about this, and thought to share if anyone here might be impacted.

On October 21, 2026, a massive cybersecurity crisis emerged after researchers publicly disclosed two critical vulnerabilities in the core PHP programming language. Collectively dubbed "PHP2Shell", these flaws affect an estimated 70% of the world's websites and allow unauthenticated remote code execution (RCE). [1, 2, 3]
Because the flaws lie in the core engine rather than application code, any server running a vulnerable PHP configuration can be completely hijacked remotely. [1]

Vulnerability Overview
The flaws are tracked under two CVEs, both receiving a critical CVSS score of 9.2: [1]

• • CVE-2026-109618: An out-of-memory (OOM) handling error. It can interrupt PHP while request data is only partially initialized, causing the request cleanup process to misinterpret invalid data as valid, resulting in memory corruption and RCE. [1, 2]
  • CVE-2026-109619: A dangling internal request state issue. A request-owned internal state can survive after its backing memory is freed, allowing a subsequent request handled by the same worker process to use that stale state before initialization resets it. [1, 2]

 

[Sic]

I imagine anyone impacted knows about it, if not then RIP

 

[reedreddington]

From what I understood about this was that the vulnerabilities had been there for years, but when AI discovered it and then they worked on a patch to fix it - the fix was able to be reverse engineered which opened up a short window of time where bad actors could utilize the vulnerability on unpatched php apps.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

www.wiz.io

 

[Redbot]

The first time I had a website compromised it was by L12ard, one of the OG MQ'ers. I had a password sitting in a file I'd renamed to index.php.bak They emailed me how they did it and helped me fix it up.

 

[SGM]

It's good to know the RG team is all over this!

 

[Redbot]

The exploits are coming in fast these days, and I worry it's going to make guild and hobbyist websites even more rare.

 

[SGM]

Unless you host your sites at skynet.com you are toast....

 

[SGM]

My toaster said that's not funny....

 

[durango773]

The exploits are coming in fast these days, and I worry it's going to make guild and hobbyist websites even more rare.

Its a battleground in the cyber space current

 

[reedreddington]

Everyone used Discord these days. It is kindof annoying. I miss my old internet 1.0

 

[Redbot]

My toaster said that's not funny....

it's true though, replace skynet with cloudflare

 

[SGM]

Sadly, very true...