They're on top of it as I would expect any major PHP hosting service to be. After asking if there was anything I could do to prep for php2shell (seemingly not), I just pleaded to be first in line when they apply patches and let them go.
How are others in similar situations handling this?
There are a handful people responsible for doing a release. They are still asleep.
To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...
German article: https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-w...
Beats panicked boss banging on the door. If there’s one thing I cannot handle while doing something critical in production, it’s panicked boss in the same room as me.
In those cases I'd rather the boss pounding at the door at least I could call the police and have them removed.
I agree with GP that my first instinct would be "lawyer", but I'm imagining the police at the door saying something like "hey we're here to inform you there's an urgent xyz, we'll now be on our way" and leaving. At that point that's the police matter resolved, no?
https://x.com/MagicalTux/status/2112725774025572431 https://x.com/rina4_tot/status/2112723421641531772
I think this exploit + agentic AI (which allows for rapid secret exfiltration/utilization) may be a potent enough combo to trigger a sort of Kessler Syndrome for network security.
But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building
but this time it's php directly? that's scary
If the rumors going around are true this will be the worst computer security incident in history.
Temporaly mitigation
php.ini: session.upload_progress.enabled = Off
https://phpc.social/@Girgias/117476510850918355
https://old.reddit.com/r/PHP/comments/1xb2utu/comment/phyu5m...
Of course you can do this with web server (eg Apache) config as well, but the CF rule is something you can do now on your phone.
I’m not saying I know this works as a mitigation, but it seems like it could at least contribute to a temporary guard until you get patch in place. Everything I’ve seen about the exploits seem to revolve around multipart form submissions.
If they can't, why not?
If they can, why haven't they already?
If you only tell them to find issues in PHP - the strongest models probably still can, although they might find different issues ;)
The original exploit, and then when the rumors of a big critical patch got out, the people who are leaking the details online probably used an LLM to find the exploit again.
Just revealing that an unpatched exploit exists in $XYZ these days basically guarantees that a bunch of people are going to target $XYZ with LLMs looking for that exploit.
Well, that would be super nice of them.
From a Machiavellian standpoint it may benefit the people with the most powerful models to let some serious RCEs like this PHP one get widely exploited in damaging ways to further their regulatory capture argument that open weight models have to be legally banned and only locked down models with enforced guardrails around usage can be allowed.
php.ini:
session.upload_progress.enabled = OffAre you speaking officially here?
There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?
I don't think pulling mitigations from random users online during a developing situation is a good idea. I think shutting down ones PHP services for the time being is a very good idea if that's an option.
I shut down my servers five hours ago. This might have seemed premature at the time.
I think the best course of advice for most people is to shut down their servers as soon as they possibly can.
https://cert.europa.eu/publications/security-advisories/2026...
> affect PHP versions 5, 6, 7, and 8.
https://www.bleepingcomputer.com/news/security/php-warns-adm... (which references HN as a source - https://news.ycombinator.com/item?id=50167754)
You could do that to an internet-connected toaster with a JPEG. The system() function has nothing to do with it.
Shell access is not good, but in many places that wouldn't be the end of the world either.
Rethink your strategy
At least this time we can have LLMs rediscover it and make patches ourselves.
Here is the patch I had an LLM come up with against master: https://pastebin.com/raw/EUCF0SR0 It at least stops the PoC which is better than nothing.
With vibe coded slop tools readily available, using php in 2026 is just laziness.
I know there must be a ton of random sites which makes this a huge deal.
But, does it affect any big players? I think php is big at Meta but I would imagine its so heavily customized it might be safe from this.
It gets used because people would rather say nice things like "PHP is alright" and "PHP has its place", than the hard truth. It is the political poster child for the software development domain. And shitting on it is almost career suicide and saying nice things about it would help fitting in...
But nature does not give a fuck about political correctness...