#phpc

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details →

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

PHPでスマホ乗っ取られて今これ🥵🥵🥵 なんか削除できなくなって変な英文入力される、終わった😭😭😭

🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE. And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room. Hackers don't wait. Neither do we 🟢 Go Get hands-on:

UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here:

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

A flaw in the code behind most of the internet is now under attack and researchers have found two critical bugs in PHP. The flaw hid in PHP for over a decade, until AI found it. But AI can help attackers too. Within 45 minutes of the warning, one firm logged tens of thousands of attacks. Governments from Washington to Brussels told everyone to patch now, and some pulled their sites offline. Now it's a race to fix the web first.

Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619). Pure logic bug — no memory corruption, ASAN-clean, orthogonal to the CVE-2026-109618/19 class. Receipt: uid=33(www-data) over HTTP, one-shot #infosec #php2shell #php

.... Dude the internet is cooked .... This can't be patched out 😈... #CyberSecurity #infosec

Update: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root

Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.

Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped.

【PHPの脆弱性対応に伴うメンテナンス終了のお知らせ】 10/21(水)22:30ごろより実施しておりました 「PHPの脆弱性対応に伴うメンテナンス」につきまして、作業が完了しサービスを再開いたしました。 長時間のメンテナンスとなり、お客様には多大なるご不便とご迷惑をおかけしましたことを深くお詫び申し上げます。 メンテナンス実施に伴うお詫びアイテムの配布や各種イベントの期間延長・補償などの詳細は、アプリ内お知らせをご確認ください。 今後とも【777Real】をよろしくお願いいたします。 #777Real

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560 The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. ⠀ PHP says exploitation requires an unusual configuration where an application: • Uses php_binary or php_serialize as its session serializer • Changes the serializer to php at runtime before session_start() • Has session upload progress enabled ⠀ PHP considers the risk unlikely and plans to release a fix during its next regular update cycle. Until then, administrators with affected configurations should set: session.upload_progress.enabled=0 Applications that do not change the session serializer at runtime are not exposed through this path. No exploitation has been reported. Source:

If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* #php #phpc @ThePHPF

‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes. This time, a Brotli flaw could allow code execution when cURL automatically decompresses crafted HTTP responses. Updated builds cover PHP 8.2–8.5. Full details:

Curious question for PHP Devs. If you were to build a web scraper in PHP, which library would you use? #php #laravel #phpc