These new PHP vulnerabilities are a big deal, y'all. My admin tells me in-the-wild exploitation was seen earlier today. There are apparently several proof of concept exploits floating around that let you send arbitrary commands to the server.
https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
BrianKrebs
npub1rf…5t9xk
2026-10-21 13:50:20 UTC
Author Public Key
npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xkSeen on
wss://relay.ditto.pubPublished at
2026-10-21 13:50:20 UTCEvent JSON
{
"id": "1b37910ad2a7a3fa5b8bc0fdaf1c3941de1d9f512cb4e336da41ae3fe7afac35",
"pubkey": "1a5ac5b37984c5e37a11bc914029a81f025326ea7950c9475d9a3f21a494cb56",
"created_at": 1792590620,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/briankrebs/statuses/117479218922822021",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "These new PHP vulnerabilities are a big deal, y'all. My admin tells me in-the-wild exploitation was seen earlier today. There are apparently several proof of concept exploits floating around that let you send arbitrary commands to the server.\n\nhttps://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/",
"sig": "d9b51d88c232b8c95c812623bbcb79f403cd6de47c7b034a72a2b7b84b8d177c3346b3c3ac9b69a42c12af3f59271ed6aaad32bf531e0b3c6bfcaacbf2b4606b"
}