Chris Silverman 🌻 (@csilverman@mastodon.social)

Nothing puts the lie to "PHP is irrelevant" like "good morning, 70% of the internet needs to be fixed ASAP".

PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)

PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific c...

PHP developers issue updates to fix vulnerabilities, says flaw was found in 2024

Developers of the PHP programming language said a set of new ​updates fixing two previously identified critical vulnerabilities was now live, and acknowledged ‌a delay in addressing a previously identified flaw.

‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.

Gina Peter Banyard (@Girgias@phpc.social)

@whitequark@treehouse.systems The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

Critical Vulnerabilities in PHP

Critical Vulnerabilities in PHP

Today's PHP Security Release, and How We're Strengthening PHP Security

Describing the story behind how critical security vulnerabilities were found and fixed.

Today's PHP Security Release, and How We're Strengthening PHP Security

Describing the story behind how critical security vulnerabilities were found and fixed.

Today's PHP Security Release, and How We're Strengthening PHP Security

247 votes, 49 comments. We have posted more information about today's security releases, including the sequence of events that led to the discovery…

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Why everything was broken yesterday

Unsolicited tech advice about the two issues (PHP, compromised certificates) that, separately, each pose some security risks and are worth attending to.

What is PHP and why did it take government websites offline?

The developers of PHP said they would release patches for two critical vulnerabilities.

Governments, companies take websites offline over PHP flaws

Several government, school and hospital websites across Europe and beyond were taken offline on Wednesday as organizations rushed to protect themselves from two critical security flaws in PHP, a programming language that powers a large share of the internet.