A PHP Bug Just Took Websites Offline Worldwide (youtube.com)
It's called PHP2Shell. Discovered by Calif, who used GPT-5.6 Sol as part of their Patch th Planet initiative), according to OpenAI. Wiz (now owned by Google) also did using Gemeni 4 Argon. Calif_io tweeted that it was lcfr_hax who first tweeted about it Aug 5, using no special GPT models, just regular GPTs everyone can use, because that person was familiar with PHP's history and already had a theory about where bugs were hiding. In 2024 PHP Foundation talked about the first signs of this problem but no one could exploit it.
Railway said their recent hack prehaps looks like the hackers used this.
An AI SRE observability stack. You have to update your php, not just an app or something. Every PHP version for past decade succeptible.
A request, if it runs php out-of-memory at just the right/wrong moment, 'PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory.' So someone can run their own code on your server without logging into your server, ie remote code execution.
I checked and my hosting provider said they weren't vulnerable. I messaged their AI Agent, and it said,
‘I understand why you want to update PHP after the recent PHP2Shell reports. [The hosting company]’s managed hosting environments were checked and are not vulnerable, and attack attempts are already blocked. Officially patched PHP versions are being rolled out automatically, so you do not need to change PHP versions or take any action, and no downtime is expected. There is no ETA yet, but updates will be provided on Hostinger’s status page.’
I asked it to double check my sites, because most are handcoded simple HTML/PHP sites. The Agent said,
'I double-checked the hosted sites I could retrieve:
9 sites: PHP 8.3
2 sites: PHP 8.2
5 sites: PHP 7.4
The PHP version check itself does not indicate that any of them are vulnerable to PHP2Shell. [The company]’s security testing confirmed that managed hosting environments, including yours, are not vulnerable, and attack attempts are already blocked.
'One account listing reported 17 entries but returned 16 site records, so I can’t honestly call the inventory fully complete. I also recommend not changing PHP versions just for PHP2Shell. Official patched versions will be deployed automatically, with no action required.'
Will people become sick of PHP?
PHP 8.2 through 9.5 are got proper releases from PHP, and older ones (8.1 and earlier, which is 60% of servers), got patches you have to patch yourself. Long tail.
Debian and Ubuntu and deb.sury.org have patches for this all the way back to PHP 7.4, and people thanked them.
Clouflare switched on web application firewalls (WAFs) ‘starteing October 21 3:01 am UTC) for all free and paid accounts. They did this about 9 hours ahead of public disclosure. They said they later 'observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.'