A bit of follow-up on the PHP exploit-global emergency website update that's been in the news recently, and how bad it was: turns out most of the fix' deployment that saved the internet rested on a single, free-software volunteer. theatlantic.com/technology/202… The XKCD law of Free Software remains undefeated:
TL;DR While you should probably update your PHP instance where possible, there's a surprising lack of real working exploit code kicking around. "The second [log4shell/Shellshock/Heartbleed] made the news, there were botnets doing the rounds causing damage [before LLMs]" - eliastaylor.com/noexploit/ The #NodeJS security releases that came out yesterday also fixed high severity issues. In 2026 you need to keep any system exposed to the internet fully patched otherwise you're running a real risk.
Your PHP server can be rooted by a single HTTP request — no login, no payload you can spot in the logs. php2shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated RCE, already exploited in the wild. Fixes landed yesterday: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. And patching the disk is not enough — the old binary keeps running in RAM until the FPM service actually restarts. Step-by-step emergency patching guide: #PHP #CVE #InfoSec #SysAdmin
Yesterday, developers released vital patches for PHP, a programming language that powers roughly 70% of the world’s websites, warning that if those patches aren’t manually deployed ASAP, hackers could cause serious damage. news.rgrichardson.ca/2026/10/a…
