Developing story
PHP RCE Flaws Found by watchTowr, OpenAI, Google's Wiz
PHP RCE Flaws Found by watchTowr, OpenAI, Google's Wiz: 5 developments over 3 days, since 21 October 2026. Latest, 23 October 2026: UK ministers say 32 government services are unavailable and four more are partly disrupted after two critical flaws, collectively called PHP2Shell, were found in PHP.
Timeline
- Oesnada
Security brief: 5 vulnerabilities to know today
UK ministers say 32 government services are unavailable and four more are partly disrupted after two critical flaws, collectively called PHP2Shell, were found in PHP.
Also on our radarInterview: Ondřej Surý on Fixing Two Critical PHP Security VulnerabilitiesThe Atlantic
Two serious security flaws in PHP, a programming language used by roughly 70 percent of websites, became public this week after researchers using a frontier AI model from OpenAI discovered them. If exploited, the vulnerabilities could let attackers take full control of a server, steal or copy its contents, or knock a site offline. The PHP Foundation, which maintains the language, had only recently learned of the problems when word of the disclosure leaked on a forum before a patch was ready. What followed was a race among the foundation, which had to build and release a fix, developers worldwide, who had to deploy it, and attackers trying to exploit the flaws in the meantime. Cloudflare CEO Matthew Prince wrote that in the 10 hours before the public announcement, the company saw thousands of exploit attempts. That rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions afterward. Once the patch was released, websites across the internet went offline to apply it, including government sites in Germany and Finland, some hospital and school sites in Europe, and international sites such as 4chan. Amid the scramble, one name kept appearing in posts on Reddit and X: Ondřej Surý, a relatively anonymous volunteer who had been working on PHP security.
Read at the source- Ars Technica
PHP2Shell Vulnerability: Hackers Got a Four-Day Head Start
Amazon says two vulnerabilities in PHP, a programming language that underpins much of the web, are now being "broadly exploited in the wild." The cloud computing provider said it identified a hacking attempt against the flaw four days before the weakness was publicly disclosed.
- Oesnada
Security brief: 5 vulnerabilities to know today
Two critical flaws in PHP, the open-source language that powers a large share of websites, are being exploited after fixes were released on Wednesday.
Also on our radarInternet Faces a Very Bad Day for Cybersecurity IncidentsTechcrunch
Government websites around the world went offline on Wednesday after AI reportedly uncovered critical security flaws in PHP, a widely used programming language for web servers, according to Reuters. The U.S. National Security Agency advised any organization running PHP to update immediately or take its systems offline until it could. One of the flaws allowed remote code execution, meaning an attacker could run commands on a vulnerable system, and two others would have allowed a bypass of TLS validation, the checks meant to verify a server's identity. PHP was not the only problem that day. LiteLLM, a popular open source proxy that routes requests to multiple large language model providers, said on X that an attacker had injected malicious code into its software. Malicious files were published to PyPI, Docker Hub and GitHub Container Registry. The code reportedly included an information stealer aimed at cloud credentials, passwords and AI service credentials, plus a remote access trojan that could let attackers run commands on infected systems. LiteLLM said it has removed the malicious releases and images and urged anyone who installed them to follow its remediation guidance. Separately, the Indian certificate authority eMudhra had its private keys compromised, which could let attackers issue fraudulent certificates and impersonate legitimate websites. Some security professionals described the cleanup as a massive job, "bigger than Heartbleed," a reference to the critical flaw in the OpenSSL cryptographic library. The incidents followed other recent events, including a breach of the database service TiDB Cloud announced Monday, attacks on four patched Plex Media Server flaws collectively called Plex2Shell, and a warning from BeyondTrust to patch a critical zero-day in its Remote Support product that had been exploited since August. The issues are unrelated, but their timing highlights the strain on security teams, particularly as AI could make it easier for attackers to exploit vulnerabilities once they are found.
Read at the source- TechCrunch
OpenAI and Google's Wiz Find Ancient PHP Vulnerabilities, Raising Internet
The National Security Agency warned on Wednesday that two critical vulnerabilities have been found in PHP, the server-side programming language behind roughly 70% of websites, by some accounts more than 33 million sites.
- Ars Technica
PHP Plans Two Emergency Patches for Critical Remote Code Execution Flaws
PHP's maintainers have scheduled emergency security updates for two critical vulnerabilities, each rated 9.2 out of 10 on the CVSS v4.0 severity scale.
Also on our radarPHP Team Plans Tomorrow Fixes for Two 9.2-Rated RCE Flaws Found by watchTowrBleepingcomputer
The PHP security team is warning administrators to get ready for emergency security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). The updates will fix two critical vulnerabilities, each rated 9.2 under CVSS v4.0, a standard severity scale. The team says it may release earlier if details become public or if attacks appear in the wild. It has not yet shared which PHP versions are affected, how the flaws can be exploited, or which releases will carry the fixes. The warning comes after information about the flaws reportedly leaked ahead of a planned disclosure. Security firm watchTowr says the two remote code execution flaws, which could let attackers run their own code on a server, were under embargo for release on Thursday. CEO Benjamin Harris told BleepingComputer the vulnerabilities are real and believed to affect PHP versions 5, 6, 7, and 8. PHP runs many websites and web applications, including content management systems, e-commerce platforms, and custom web services, so flaws of this kind could reach a wide range of sites. The accounts differ in places. watchTowr and a since-deleted Hacker News post described the flaws as CVSS 10.0, while PHP's official rating is 9.2, and watchTowr cited a Thursday disclosure rather than Wednesday. watchTowr says it believes it has reproduced CVE-2026-109618 but will hold back technical details until patches are available, and it has not seen exploitation in the wild. PHP says it will publish full technical details, affected versions, and fixed releases when the updates ship, and it urges administrators to be ready to install them immediately.
Read at the source
Topics in this story
Methodology and sources
Oesnada groups published stories into a developing story when a language model judges that they continue the same thread. The grouping is automatic and can be wrong. A thread gets a page once it has at least 3 developments spread over at least 2 different days. The one-line updates and the summary are written automatically from Oesnada stories only, and every number in them is checked against those stories.
Cite this page
Oesnada, "PHP RCE Flaws Found by watchTowr, OpenAI, Google's Wiz", https://oesnada.com/storylines/php-critical-remote-code-execution-flaws-found-by-watchtowr, accessed 23 October 2026.