PHP security team announces emergency security release

Oct 23 · Cloudflare reports millions of exploit attempts Updated 19:31

Cloudflare reported that millions of exploit attempts occurred shortly after the disclosure, according to Business Insider.

The report of millions of exploit attempts shortly after disclosure confirms that the window for remediation has effectively vanished. This scale of attack validates the systemic risk identified in the first analysis, as the sheer volume of attempts makes it nearly certain that unpatchable legacy hosts are being compromised in real time.

Business Insider shifted the focus toward general digital hygiene for end-users, offering tips on password managers and two-factor authentication. This approach treats the crisis as a personal security issue for the public rather than a structural failure of internet infrastructure. By pivoting to individual precautions, the coverage avoids the more difficult question of why so many critical systems remain on obsolete software that cannot be secured.

Oct 22 · Researchers discover PHP vulnerabilities allowing remote code execution and memory access Updated 02:39

Researchers from Wiz, OpenAI, and Calif, some of whom used AI tools including Gemini 4 Argon and GPT-5.6 Sol, discovered vulnerabilities that allow remote code execution and memory access. According to WIRED, these flaws affect nearly all PHP installations serving web requests, including legacy versions. Newsweek reports the vulnerabilities affect PHP versions 5.4 through 8.5.11, and TechCrunch states they have been present since 2004. TechCrunch further reports that the flaws allow attackers to infiltrate server file systems or databases, while ABC News reports they could allow unauthenticated remote code execution. Business Insider reports the flaws were identified as part of OpenAI's 'Patch the Planet' initiative and potentially put 70% of the world's websites at risk of data theft or unauthorized modification. Newsweek lists Joomla as one of the potentially affected major platforms. Sansec has warned of immediate, mass exploitation risks, and Wiz warns that AI makes these previously difficult flaws easier to exploit. In response, WIRED reports that the Port of Rotterdam and several government websites in France and Finland were taken offline as a precaution; Newsweek reports the Wikimedia Foundation took systems offline as a precaution; and the BBC reports the Netherlands' parliament and the BBC took their websites offline as a precaution. Mother Jones reports government sites in Canada were temporarily shut down. The FBI and national cybersecurity agencies in Australia have urged organizations to patch immediately or isolate affected systems, per WIRED. The National Security Administration's cyber division advised web providers to take systems offline or update software immediately, according to Business Insider. The PHP team stated that updating the code is the only complete solution to the risk, and TechCrunch reports the current recommended version for security is PHP 8.5.12, while the BBC reports users of PHP 8.1 or older are urged to upgrade. Additionally, Business Insider reports a Microsoft engineer warned that newer AI models will likely uncover more vulnerabilities in the future, and Mother Jones reports that OpenAI and Greg Brockman suggest the volume of AI-discovered vulnerabilities is increasing sharply, potentially requiring governments to take a larger role in infrastructure monitoring. The Independent reports that Cloudflare implemented stopgap firewall rules to mitigate early attacks, GoDaddy warned that the flaws could lead to data theft or full system compromise, and Wordfence noted that automatic WordPress updates would not fix the issue because the PHP server itself requires updating. The Washington Examiner, citing the Wall Street Journal, reports that the nonprofit foundation managing PHP described the vulnerability as the most severe security flaw the software has faced in over a decade. CNBC reports that Amazon detected exploit attempts before public disclosure via its MadPot system and that OpenAI is leading a coalition to coordinate fixes for the vulnerabilities. WIRED reports that AWS research revealed exploitation attempts began as early as October 17, four days before public disclosure, with AWS detecting early attempts via honeypots and noting the actor used a commercial anonymization network. WIRED further reports that proof-of-concept exploits emerged rapidly, with some appearing hours before the official announcement, and AWS CISO CJ Moses stated that AI tools accelerating vulnerability analysis are shrinking the window between a patch and a working exploit.

The decision by government websites in France and Finland and the Port of Rotterdam to go offline confirms that the risk has moved beyond legacy servers to critical national infrastructure. This validates the systemic danger identified in the first analysis, as the vulnerabilities affect nearly all PHP installations regardless of version.

WIRED provided essential context by revealing that exploitation attempts began four days before public disclosure. This evidence, combined with the use of AI tools like Gemini 4 Argon and GPT-5.6 Sol for discovery, suggests that the traditional embargo and patching cycle is becoming obsolete. The window between a vulnerability's discovery and its active exploitation is shrinking faster than administrators can react.

Mother Jones expanded the scope of the crisis by reporting that the volume of AI-discovered vulnerabilities is increasing sharply. This shifts the event from a failure of software maintenance to a broader question of whether governments must take a larger role in infrastructure monitoring to maintain global digital stability.

While the FBI and national agencies urge immediate patching, the reality remains that legacy versions are fundamentally unpatchable. Current coverage focuses on the immediate urgency of the crisis but continues to omit a deeper investigation into why critical infrastructure still relies on software that cannot be secured.

Oct 21 · PHP security release scheduled for October 21, 2026 Updated 10:25

Laravel News reports that the security release is scheduled for October 21, 2026, at 14:00 UTC, though the PHP team stated the release may occur earlier if exploitation is detected. According to Laravel News, the Laravel team stated that Forge and Cloud will be updated to address the PHP vulnerabilities. Laravel is working with the PHP Foundation to integrate patched images and is exploring ways to apply patches without requiring app redeployments, per Laravel News. The PHP security team announced a patch release scheduled for 10 a.m. ET on Wednesday, according to NBC News. The Verge reports that the vulnerabilities affect PHP version 5 and later, potentially allowing attackers to run malicious code, steal data, and alter websites, with a potential impact on an estimated 1.3 million hosts, including over 40 percent of the web via WordPress. Cloudflare, Patchstack, and NBC News report that early attacks and active exploitation are already occurring. GrapheneOS has taken forums offline as proof-of-concept exploits emerge, and Pinboard, parts of Wikipedia, and various Japanese systems have temporarily shut down to prevent hacker takeovers, per The Verge and NBC News. CERT-EU and the UK's National Cyber Security Centre have advised isolating applications or taking systems offline if immediate remediation is impossible, according to The Verge and NBC News. NBC News reports that the U.S. Cybersecurity and Infrastructure Security Agency has not yet responded to requests for comment.

The emergence of active exploitation and the decision by sites like Wikipedia and GrapheneOS to go offline transform the event from a theoretical risk into an active crisis. The Verge provided critical scale by estimating that 1.3 million hosts are potentially impacted, including a significant portion of the web via WordPress. This quantification reinforces the systemic risk identified in the first analysis, showing that the danger is not limited to a few legacy servers but spans a massive segment of the internet's infrastructure.

Laravel News shifted the focus toward the friction of deployment by reporting on efforts to apply patches without requiring app redeployments. While this addresses the immediate needs of managed service users, it ignores the structural failure of legacy software management. The reporting treats the crisis as a technical hurdle for current users rather than addressing the vulnerability of the hundreds of thousands of hosts on end-of-life versions who cannot benefit from such streamlined updates.