GoKawiil
Tech News
The Organization for Transformative Works took Archive of Our Own offline around 3AM ET for what was initially billed as 12 hours of maintenance, but it now estimates the site could stay down for two to four weeks. The nonprofit says stored fanworks remain intact, though it hasn't detailed what exactly is wrong.
Fan fiction site Archive of Our Own went offline during what was meant to be routine overnight maintenance and now says full restoration could take two to four weeks. The nonprofit Organization for Transformative Works, which runs the volunteer-driven site, posted the estimate on AO3's status page, adding it hopes to restore a degraded version sooner. The outage is not linked to last week's widely reported PHP security flaws, since AO3 runs on Ruby on Rails rather than PHP.
A new open-source library called phpClaw was released on Show HN, offering PHP developers a ready-made runtime for building AI agents. It includes tool integration, memory, security guards, and a ReAct reasoning loop, and works with multiple LLM providers including Anthropic, OpenAI, Groq, Gemini, Mistral, DeepSeek, and Ollama without requiring any framework dependencies.
Researchers at Calif and Wiz, aided by OpenAI and Google models, discovered two remote code execution vulnerabilities in PHP dating back to 2012, now dubbed PHP2Shell. Amazon detected exploitation attempts days before PHP's October 21 patch, and attack traffic kept climbing afterward, prompting CISA to add both flaws to its known exploited vulnerabilities list on October 26. Industry data cited shows median fix times for known exploited bugs run 21 to 43 days, far slower than the pace at which attackers are now acting.
Following last week's discovery of two major PHP vulnerabilities by a team using an OpenAI model, engineers worldwide rushed to patch websites, with some European government sites temporarily going offline during updates. Reuters reports that the PHP Foundation, the nonprofit responsible for coordinating security fixes for the software powering roughly 70% of websites, has only one full-time staff member, Executive Director Elizabeth Barron, supported by about 14 part-time contractors.
CISA has confirmed that hackers are actively exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, and ordered U.S. civilian federal agencies to patch affected systems within three days. The flaws let attackers remotely compromise systems without credentials, and PHP powers roughly 70% of web-facing servers worldwide.
Wiz Research is monitoring activity related to two PHP vulnerabilities disclosed on October 21, 2026, dubbed PHP2Shell. The firm says it has seen only limited exploitation attempts in its telemetry and no public proof-of-concept for complete end-to-end attacks, though some partners have privately shared working exploits. Wiz reports internet-exposed vulnerable machines dropped about 67% in days following disclosure, and affected organizations fell roughly 47.9%.
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.
Security researchers confirmed successful exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), just days after patches shipped and earlier exploitation attempts had failed. Adel Karimi of Perplexity reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26, including an 800 KiB decoded cookie dump and a function address matching a public exploit's offsets appearing in the execution payload. Expel researcher Marcus Hutchins corroborated the finding, calling it the highest-quality confirmation of in-the-wild exploitation seen so far.
A recent security lapse affecting PHP has been linked to insufficient funding for the project's maintenance, according to reporting on the incident. The report notes that many services continue to run outdated PHP versions that no longer receive official support, compounding the risk.
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.
Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.