***DANGER DANGER***
**Bottom line up front:**
Critical unauthenticated remote code execution flaws in PHP (called **PHP2Shell**, CVE-2026-109618 and CVE-2026-109619) were just disclosed and patched. PHP powers roughly 70% of websites. AI tools helped researchers find them. Some governments (notably the Dutch) took websites offline as a precaution. Early exploitation attempts have already been detected. Update PHP right away if you run any servers using it, and be extra careful browsing for the next few days.
### Summary of the video
Wes Roth’s video (posted October 21, 2026) explains a major ongoing cybersecurity event:
- Researchers (including Calif, with help from OpenAI’s models and later independent work by Wiz) discovered two critical bugs in the PHP core itself. These allow attackers to run arbitrary code on vulnerable servers **without logging in**.
- The flaws affect a very wide range of PHP versions (going back many years) and are especially dangerous on common setups like Apache with mod_php. They impact popular platforms including WordPress, Drupal, Joomla, Magento, Laravel, and many others.
- Details leaked a day early, prompting the PHP project to accelerate the emergency release of patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).
- Cloudflare and others reported early attack attempts. Some government sites went offline preventively while defenders raced to respond.
- The video also briefly notes related issues (e.g., extremely weak cryptographic keys in some systems and the growing use of AI by attackers) and stresses that the broader internet is under pressure right now.
### Practical advice given in the video
- Limit non-essential web browsing for the next few days.
- Keep antivirus/anti-malware running and updated on all devices (including phones).
- Use only up-to-date browsers with ad blockers; disable autoplay where possible.
- Enable multi-factor authentication everywhere.
- Use unique, strong passwords for every account (consider changing important ones).
- Keep operating systems and applications fully updated.
- If you run any PHP-based sites or servers, patch immediately or take them offline until you can.
The core message is that this is a serious, widespread infrastructure-level problem, not just another routine vulnerability, and the situation is still developing rapidly.
https://youtu.be/ehcBwqyUGjo?is=fQAQ-02Hv498OenW
#pwned
#hacked
#credentials
#beware
ImYour Huckleberry
npub1lm…rd0ae
2026-10-22 00:14:34 UTC
Author Public Key
npub1lme7lw7lj9m0jwp2v76wad4uf0ag7k6trvuawy5lup7e0lqhxuwqyrd0aeSeen on
wss://relay.damus.ioPublished at
2026-10-22 00:14:34 UTCEvent JSON
{
"id": "f51db186c171110c9c74760825f9a503d4ba2529cd97491033cbf6163ae6a3d4",
"pubkey": "fef3efbbdf9176f9382a67b4eeb6bc4bfa8f5b4b1b39d7129fe07d97fc17371c",
"created_at": 1792628074,
"kind": 1,
"tags": [
[
"t",
"pwned"
],
[
"t",
"hacked"
],
[
"t",
"credentials"
],
[
"t",
"beware"
],
[
"client",
"Primal Android"
]
],
"content": "***DANGER DANGER***\n\n**Bottom line up front:** \nCritical unauthenticated remote code execution flaws in PHP (called **PHP2Shell**, CVE-2026-109618 and CVE-2026-109619) were just disclosed and patched. PHP powers roughly 70% of websites. AI tools helped researchers find them. Some governments (notably the Dutch) took websites offline as a precaution. Early exploitation attempts have already been detected. Update PHP right away if you run any servers using it, and be extra careful browsing for the next few days.\n\n### Summary of the video\nWes Roth’s video (posted October 21, 2026) explains a major ongoing cybersecurity event:\n\n- Researchers (including Calif, with help from OpenAI’s models and later independent work by Wiz) discovered two critical bugs in the PHP core itself. These allow attackers to run arbitrary code on vulnerable servers **without logging in**.\n- The flaws affect a very wide range of PHP versions (going back many years) and are especially dangerous on common setups like Apache with mod_php. They impact popular platforms including WordPress, Drupal, Joomla, Magento, Laravel, and many others.\n- Details leaked a day early, prompting the PHP project to accelerate the emergency release of patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).\n- Cloudflare and others reported early attack attempts. Some government sites went offline preventively while defenders raced to respond.\n- The video also briefly notes related issues (e.g., extremely weak cryptographic keys in some systems and the growing use of AI by attackers) and stresses that the broader internet is under pressure right now.\n\n### Practical advice given in the video\n- Limit non-essential web browsing for the next few days.\n- Keep antivirus/anti-malware running and updated on all devices (including phones).\n- Use only up-to-date browsers with ad blockers; disable autoplay where possible.\n- Enable multi-factor authentication everywhere.\n- Use unique, strong passwords for every account (consider changing important ones).\n- Keep operating systems and applications fully updated.\n- If you run any PHP-based sites or servers, patch immediately or take them offline until you can.\n\nThe core message is that this is a serious, widespread infrastructure-level problem, not just another routine vulnerability, and the situation is still developing rapidly.\n\nhttps://youtu.be/ehcBwqyUGjo?is=fQAQ-02Hv498OenW\n\n#pwned\n#hacked\n#credentials\n#beware \n\n",
"sig": "6de2da4ea3e097ece5f096c2c0179616eec071cb91842449735c5459e8491fe48bdec3ce18eaba21215f9dda2408d16ee1d4f4af461124ecb5c88967500daabb"
}