Heads-up if you run anything on PHP: two critical remote code execution bugs in the PHP interpreter itself (CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell"). It's not a WordPress or Laravel bug: the hole is in PHP, so any site on an affected version is exposed.
Details leaked before the embargo, so PHP is shipping emergency releases today at 14:00 UTC for 8.2 to 8.5. Official severity: 9.2. No confirmed attacks yet, but researchers expect mass exploitation very soon after the patch, because the patch shows where the bug is.
What to do:
• Update the moment your version or distro gets the fix.
• Still on PHP 8.1 or older? It won't get one. Time to migrate.
• Using shared hosting? Ask your provider.
Not affected myself: my relay and client run on Go and TypeScript, no PHP anywhere. But a lot of the web is about to have a busy afternoon.
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-21 11:27:58 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-21 11:27:58 UTCEvent JSON
{
"id": "228e79e18f7951f0c58099b5ac4239330a30c6efc3e6533d28f345a418edb16b",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792582078,
"kind": 1,
"tags": [],
"content": "Heads-up if you run anything on PHP: two critical remote code execution bugs in the PHP interpreter itself (CVE-2026-109618 and CVE-2026-109619, nicknamed \"php2shell\"). It's not a WordPress or Laravel bug: the hole is in PHP, so any site on an affected version is exposed.\n\nDetails leaked before the embargo, so PHP is shipping emergency releases today at 14:00 UTC for 8.2 to 8.5. Official severity: 9.2. No confirmed attacks yet, but researchers expect mass exploitation very soon after the patch, because the patch shows where the bug is.\n\nWhat to do:\n• Update the moment your version or distro gets the fix.\n• Still on PHP 8.1 or older? It won't get one. Time to migrate.\n• Using shared hosting? Ask your provider.\n\nNot affected myself: my relay and client run on Go and TypeScript, no PHP anywhere. But a lot of the web is about to have a busy afternoon.",
"sig": "2a56813a39c0a41fb83b3c5c32dbef46125ddb56e82dc1d09eeb595b655988e01ac43ed492c66eb9a91446707c7aac416254bfe48f37178a0e865fbadea04e8d"
}