Tech - PHP Web Exploit (1 Viewer)

[SGM]

Just read about this, and thought to share if anyone here might be impacted.

On October 21, 2026, a massive cybersecurity crisis emerged after researchers publicly disclosed two critical vulnerabilities in the core PHP programming language. Collectively dubbed "PHP2Shell", these flaws affect an estimated 70% of the world's websites and allow unauthenticated remote code execution (RCE). [1, 2, 3]
Because the flaws lie in the core engine rather than application code, any server running a vulnerable PHP configuration can be completely hijacked remotely. [1]

Vulnerability Overview
The flaws are tracked under two CVEs, both receiving a critical CVSS score of 9.2: [1]

• • CVE-2026-109618: An out-of-memory (OOM) handling error. It can interrupt PHP while request data is only partially initialized, causing the request cleanup process to misinterpret invalid data as valid, resulting in memory corruption and RCE. [1, 2]
  • CVE-2026-109619: A dangling internal request state issue. A request-owned internal state can survive after its backing memory is freed, allowing a subsequent request handled by the same worker process to use that stale state before initialization resets it. [1, 2]

 

[Sic]

I imagine anyone impacted knows about it, if not then RIP

 

[reedreddington]

From what I understood about this was that the vulnerabilities had been there for years, but when AI discovered it and then they worked on a patch to fix it - the fix was able to be reverse engineered which opened up a short window of time where bad actors could utilize the vulnerability on unpatched php apps.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

www.wiz.io

 

[Redbot]

The first time I had a website compromised it was by L12ard, one of the OG MQ'ers. I had a password sitting in a file I'd renamed to index.php.bak They emailed me how they did it and helped me fix it up.

 

[SGM]

It's good to know the RG team is all over this!

 

[Redbot]

The exploits are coming in fast these days, and I worry it's going to make guild and hobbyist websites even more rare.

 

[SGM]

Unless you host your sites at skynet.com you are toast....

 

[SGM]

My toaster said that's not funny....

 

[durango773]

The exploits are coming in fast these days, and I worry it's going to make guild and hobbyist websites even more rare.

Its a battleground in the cyber space current

 

[reedreddington]

Everyone used Discord these days. It is kindof annoying. I miss my old internet 1.0

 

[Redbot]

My toaster said that's not funny....

it's true though, replace skynet with cloudflare

 

[SGM]

Sadly, very true...

 

[afortner87]

Everyone used Discord these days. It is kindof annoying. I miss my old internet 1.0

I miss when things were simpler lol. But I definitely dont miss dial up days

 

[Sic]

what was internet 1.0, like netscape? i had a friend who's mom had that og netscape where you basically couldn't see shit on the screen cause it was all banners/borders

 

[Lugnut]

If you were keeping PHP patched an current, it shouldn't be much of an issue.

 

[blahblahblah84]

what was internet 1.0, like netscape? i had a friend who's mom had that og netscape where you basically couldn't see shit on the screen cause it was all banners/borders

Yep, those were the good old days ... and dial up modems. Although all the content was static (unchanging), so there was nothing to steal. I miss those days sometimes

 

[MacQ]

what was internet 1.0, like netscape? i had a friend who's mom had that og netscape where you basically couldn't see shit on the screen cause it was all banners/borders

Internet 1.0, before browsers, was all about getting a usenet connection to “the internet”. I remember begging SDSU (San Diego State University) for an internet connection, which is how I got my first internet connection/feed for email and usenet newsgroup download/upload. There were no “websites”.

 

[reedreddington]

what was internet 1.0, like netscape? i had a friend who's mom had that og netscape where you basically couldn't see shit on the screen cause it was all banners/borders

Did not mean to confuse. I just meant like the days before Myspace and Facebook. When things were more of a Read-Only world. A lot of HTML bulletin style websites.

Web 1.0 was all about fetching and reading information. Web 2.0 is all about reading, writing, creating, and interacting with the end user. It was famously called the participative social web. Web 3.0 is the third generation of the World Wide Web, and is a vision of a decentralized web, which is currently a work in progress. It is all about reading, writing, and owning.

 

[Redbot]

web 3.0 is where people watch influencers

 

[reedreddington]

Ya I hate the current web, except RG. And influencers. Ew.