PHP-to-Shell Bugs Force Mass Website Shutdowns: Critical Remote Code Execution Threat

The NSA and other cyber agencies across the world are telling organizations to take their websites offline if they

can't patch them. Big names like 4chan went down, parts of Wikipedia went down, and even hacker forums like breach

forums have switched themselves off. All of this because of two bugs in PHP, and PHP runs roughly 70% of the internet.

So, the scale of this could be massive. The researchers who found them are comparing this to heartbleleed and log

for shell. [music] So, these two bugs are being called PHP to shell, and they went public on

Wednesday with a score of 9.2 out of 10. And an important thing to know here is this isn't WordPress or some dodgy

plug-in like we've seen before. This is in PHP itself. So, updating your app doesn't fix this. You have to update

PHP. The PHP Foundation's short version of how this works is if a request runs PHP out of memory at exactly the wrong

moment, PHP can leave half-built data behind and later trust it. And with the right request, that means someone on the

internet can run their own code on your server without logging in. So they can have remote code execution. The security

researchers whiz showed this exploit working against fresh installs of the latest versions of WordPress, Drupal,

and Jumla. And they say this can even impact a hello world application as it's the language itself that's vulnerable.

They say that every version of PHP from the last decade can be exploited by one of these vulnerabilities. So if you're

watching this video and you just remember that you have a PHP server set up somewhere, go ahead and update it.

and also subscribe because I see about 80% of you aren't subscribed and it really helps us out. Now, how these two

bugs were disclosed was a bit of a rocky ride. It was meant to be a calm, coordinated release. The plan was to

publish everything on a Thursday, but on Tuesday afternoon, the two CVE numbers got posted to Hacker News with the wrong

severity, claiming they were both a perfect 10. The person who has posted this since apologized and said that

source told them there was no embargo. But because of this, that evening, PHP gave everyone advanced notice and pulled

the release forward a day. Around the same time, Califf, one of the firms that found the bug, mistakenly published a

video of their exploit working against real targets, and it did get deleted, but copies of it were going all around

Twitter. Then on Wednesday morning, more than 6 hours before the release, Chain Guard published patched PHP images, and

the PHP Foundation says that unilaterally broke the embargo because anyone can now go study the fix while

everyone else was still waiting. So, by the time the patch actually landed at 2 am UTC, everyone already knew roughly

where to look. Whatever happened to responsible disclosure? Now, obviously, people began racing to build an exploit,

and since there's a lot of servers that won't be patched in a day, the advice got pretty drastic. The NSA, CISA, the

FBI, and the UK's NCSC all said that if you can't update straight away, take the system offline. Even Japan's prime

minister tweeted about this. As a response, we saw a wave of websites going down. In the Netherlands, DigD,

the national login service went down along with Parliament's website and even the national cyber security one. In the

UK, Edinburgh, Bristol, and Oxford, their sites went offline. Wikipdia took some systems down. And 4chan and

Something Awful also went offline to wait for the patch. Levels, one of the biggest PHP fans that I follow on

Twitter, disconnected every single server of his business before the patch dropped. And once this admin on Reddit,

said it was the first time in 20 years they' deliberately taken their website down. In a fun bit of irony as well,

Breach forums also went offline and the moderator said they will stay down until PHP is patched and we take our security

seriously. I mean, yeah, I suppose the forum with all of the hackers is most likely to be hacked as well. Now, one of

the reasons this might not have the scale that it could potentially have is because Cloudflare for sale and a few

others were told weeks in advance, so they quietly built firewall rules. Cloudflare switched on for every

customer at 3 a.m. UTC on Wednesday, and they say they watched attackers tweak their payloads to try and get round

them. So, has half the internet been hacked? Well, not as far as we know. Watchtower says they are seeing real

attempts in the wild using exploit tools fivecoded with AI, but now words, nobody has been successful to date. CISA also

says it hasn't seen successful exploitation attempts yet. So, right now, the damage is mostly in the

websites that people chose to switch off. But the real worry is in the long tail. Only 8.2 and newer got proper

releases, and older versions got patches you have to build yourself. And one scan found that 59% of servers show a PHP

version of 8.1 and older. And that's the stuff that probably won't get patched this week or maybe ever. It's worth

mentioning here. Andre Suri, who maintains the PHP packages a lot of Debian and Ubuntu servers pull from,

those packages had fixes all the way back to PHP 7.4, which is an absolutely awesome move. Now, another bit of chaos

in this story is who actually found this bug. OpenAI says Califf found this using GPT 5.6 6 soul as part of OpenAI's patch

the planet program and that OpenAI led the group that got everyone ready. They're calling it one of the most

impactful vulnerabilities in recent memory. Whis found this independently and they say Gemini 4 Argon made an

invaluable contribution and it's worth knowing that Whiz is owned by Google now. Then Califf posted saying let's set

the record straight saying that researcher was first and pointing to a tweet from August 5th as the proof. And

in Callus write up, they say the researcher used no special harnesses and no models that weren't available to

everyone. They picked PHP because they knew it history and had a theory about where the bugs were hiding. And what

he's referring to here is a 2024 security audit by the PHP Foundation that already found the first signs of

this exact problem, but nobody could prove it was exploitable. So the fix kept stalling. In our words, that was

actually a structural failure. And they'd even scanned PHP with Anthropics Claude Mythos earlier in the year, and

that seemingly missed it, too. So, what had changed this time? Well, the bug class itself goes back to a research

from 2004. What changed is how far someone who knows where to look can turn an old theory into a working exploit.

Whis says one researcher did in a week or would have taken a world-class team months. And that's the scary part. None

of this is going to slow down. On this same day, No.JS patched a remote code execution bug of its own and GitLab

shipped a fix for one rated a full 10 out of 10. Then on the same evening, I've literally just seen that Railway

announced a breach. They say someone got into the systems that store customer environment variables and for some of

them got decrypted values. So API keys, databases, passwords, all have been leaked. Nothing links this to PHP to

shell, but Railway says it looks like part of a series of attacks on platforms aimed at getting AI provider keys.

OpenAI says that PHP to Shell is one of several big bugs it's already found, and he expects findings are likely to

increase sharply in the coming months. Taylor Artwell, who created Laravel, put this pretty well. He said, "It probably

won't be the last time, and PHP probably won't be the only language that goes through it." Overall, I think the bug

itself was the least interesting part of this story. The fix was ready. The CDN's ready, but it still turned into chaos

because news got out a day early, and because of AI, a few hours is all it needs for people with AI agents to start

building exploits. Disclosure was built for a world where finding the bug was the hard part. And I don't think we live

in that world anymore. So, if you run PHP anywhere, even on some server you forgot about, go ahead and update it.

Let me know what you think about all of this in the comments down below. While you're there, subscribe. And as always,

see you in the next one. >> [music]