A developer released stealmybitcoin_poc.py, a standard-library Python script that reproduces the request sequence used to solve the 'Steal My Bitcoin' CTF challenge against PHP 8.4.26. The exploit abuses memory exhaustion during multipart session upload-progress parsing to leak heap and code addresses, then forges a HashTable to trigger a system() call via fewer than 20 HTTP requests. The author notes the script targets a local Docker lab replicating the challenge's Alpine/nginx/PHP-FPM setup rather than the live competition target.
github.com
· 2026-10-26
Matthew Prince told Reuters that Cloudflare has identified several other severe vulnerabilities in widely used critical software, beyond the recent PHP flaws that knocked government sites, GOG, and other websites offline. He said AI tools are making it far easier for both researchers and attackers to find and exploit such bugs in core internet infrastructure.
techspot.com
· 2026-10-25
Security researchers discovered serious vulnerabilities in the open source PHP programming language this week, prompting urgent warnings for website owners to patch immediately or take sites offline. TechCrunch's Equity podcast hosts discussed the incident, noting the flaws were found by human researchers rather than AI tools.
techcrunch.com
· 2026-10-24
Researchers discovered two long-dormant vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that let attackers break into password-protected servers running the widely used web language. The PHP Foundation released public patches on Wednesday after giving major internet companies and hosting providers early access, prompting banks, hospitals, retailers and government agencies worldwide to take sites offline to update their systems.
techcrunch.com
· 2026-10-24
Security researchers at Calif, OpenAI, and Wiz used AI tools to independently uncover practical exploits for long-known but previously unexploitable PHP vulnerabilities, collectively named PHP2Shell. Within hours of public disclosure, Cloudflare recorded millions of exploitation attempts, though the PHP Foundation says no successful breaches have been confirmed and many circulating exploits appear ineffective.
wired.com
· 2026-10-24
Security researchers report that organizations are patching newly disclosed PHP vulnerabilities, dubbed PHP2Shell, much slower than attackers are exploiting them. Cloudflare's CEO said exploitation attempts rose from thousands to millions within hours of disclosure, while Check Point found 10% of organizations worldwide had already seen exploitation attempts. Ox Security and Flare separately found that over 97% of scanned instances had not advertised patched versions a day after fixes were released, and roughly half may never be patched, according to Cisco Talos.
darkreading.com
· 2026-10-23
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 in severity, affect most PHP builds and were patched by the PHP Project on Wednesday. Security firm Wiz, which found the flaws with AI assistance, says PHP runs on roughly 70% of websites worldwide, and the bugs allow memory disclosure and unauthenticated remote code execution independent of the application running on PHP.
zdnet.com
· 2026-10-23
Microsoft CEO Satya Nadella said he hadn't seen a cyber-security scramble like this in years, referring to the global rush to patch critical flaws found in PHP, a programming language used by millions of websites. National cyber-security agencies urged IT teams to install patches immediately or take affected sites and servers offline, prompting system administrators to work through the night fixing and securing client systems.
bbc.co.uk
· 2026-10-23
The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
bleepingcomputer.com
· 2026-10-23
The PHP team released PHP 8.6.0 RC4, the third release candidate in the 8.6 cycle, which patches two critical vulnerabilities that could allow unauthenticated remote code execution. Users running earlier 8.6.0 builds are urged to update immediately, though the team stresses RC4 remains a test build not meant for production use. A further release candidate, RC5, is planned for 5 November 2026.
php.net
· 2026-10-23
A Hacker News user named petecooper publicly apologized after posting details of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, ahead of a coordinated disclosure embargo. They said contacts had told them no embargo existed, and that they only wanted to warn others following PHP's four-week release cycle. The PHP Foundation had to move up its official announcement after multiple leaks, including one from Chainguard, surfaced before the planned release.
tomshardware.com
· 2026-10-23
Security researchers at Calif (working with OpenAI's Patch the Planet program) and Wiz (owned by Google Cloud) independently found two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both teams used frontier AI models, including GPT-5.6 Sol and Gemini 4 Argon, to identify the flaws and build working exploits. One of the bugs had actually been flagged in a 2024 PHP Foundation audit funded by the Sovereign Tech Agency, but was left unpatched because no one could devise a practical exploit at the time.
drew.silcock.dev
· 2026-10-23
GoKawiil