Two critical PHP vulnerabilities (PHP2Shell) force emergency patching as exploitation attempts reportedly reach millions
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 02/11/2026 00:02; os links antigos trazem para cá.
Fontes: techcrunch.com ×3 ↗
Two critical vulnerabilities in PHP, the language behind roughly 70% of websites, forced emergency patching in the week before 2026-10-28, and some organizations, including reportedly some governments and popular sites, took systems offline until fixes were applied (techcrunch.com). The flaws are referred to as PHP2Shell and were handled in a coordinated effort by Wiz, OpenAI, the research group Calif and the PHP team (techcrunch.com). An earlier report (2026-10-24) said some parties got ahead of the embargo, setting off a race among attackers. It also said Cloudflare CEO Matthew Prince described millions of attempted attacks, and that Amazon saw exploitation attempts in its honeypot network before public disclosure (techcrunch.com). The later piece (2026-10-28) gives no evidence of exploitation in the wild, so that claim is secondhand and unverified. It adds that Wiz CTO Tomer Schwartz says Wiz could not have found the bugs without AI, that one bug sat unnoticed for more than a decade, and that some systems remain unpatched (techcrunch.com). Both sources are TechCrunch Equity podcast discussions or promotions, not primary research, and neither gives CVE identifiers, affected versions, IOCs or exploit mechanics.
Entenda a falha
A vulnerabilidade
Two critical vulnerabilities in PHP, the open source language behind roughly 70% of websites (including WordPress and Drupal sites), forced emergency patching. They are referred to as PHP2Shell. The articles give no CVE IDs, flaw types, component, attacker prerequisites, impact, or affected and fixed versions. Site owners were told to patch immediately or take sites offline, and some systems reportedly remain unpatched. Check the official PHP advisories for versions and CVEs.
Como funciona
The articles do not describe how the vulnerable code path works, what input reaches it, or at which step it fails. The name PHP2Shell hints at a path toward running commands on the server, but the articles do not confirm this. The mechanism of both bugs is not public in these sources.
Por que é vulnerável
The root causes are not given. The articles say only that one of the two bugs sat unnoticed for more than a decade, and that something changed that made it exploitable, without saying what. The earlier piece speaks loosely of a flaw that existed for decades. The later piece supports that age only for one bug. The fix is described only as PHP security patches, with no detail on what they change.
Como foi descoberta
The disclosure was coordinated among Wiz, OpenAI, the research group Calif and the PHP team. The accounts of how the bugs were found differ. The 2026-10-24 piece says human researchers in the OpenAI and Wiz Hack the Planet initiative found them and used AI to exploit one, and carries a correction saying an LLM did not find them. On 2026-10-28, Wiz CTO Tomer Schwartz says Wiz could not have found the bugs without AI, using custom tooling that tested dozens of ideas over a weekend. The earlier piece says some parties got ahead of the embargo. It relays that Cloudflare CEO Matthew Prince saw millions of attempted attacks and that Amazon's honeypots saw exploitation attempts before the announcement. These claims come secondhand from podcast hosts and are unverified. Schwartz says leaks are almost inherent to coordinated disclosure and that Wiz planned for it.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 00:17.
Detalhes técnicos
- PHP underpins CMSs such as WordPress and Drupal and, per the podcast hosts, roughly 70% of websites (techcrunch.com).
- The earlier article says the vulnerability has existed for decades. It gives no CVE IDs, affected versions or exploit mechanics (techcrunch.com).
- The 2026-10-28 article does not name the flaw types or the CVEs. It says one of the two bugs remained undetected for more than a decade before AI-assisted research made it discoverable and exploitable (techcrunch.com).
- Exploitation attempts reportedly began before the public announcement (Amazon honeypot telemetry) and escalated to millions of attempts involving "PHP2Shell" (Matthew Prince, per techcrunch.com).
- Tomer Schwartz, CTO of Exposure Management & AppSec at Wiz, argues that AI is shortening the time needed to discover and exploit novel vulnerabilities and that manual patching will not scale (techcrunch.com).
- Schwartz says Wiz could not have found the bugs without AI, using custom tooling to test dozens of ideas over a weekend (techcrunch.com).
- Schwartz says leaks are almost inherent to coordinated disclosure and that Wiz planned for this (techcrunch.com).
- Some systems remain unpatched. The podcast episode addresses whether WordPress site owners are at risk, but the article gives no answer (techcrunch.com).
Remediação
- Patch PHP immediately. If that is not possible right away, take affected sites offline (techcrunch.com).
- Apply the latest PHP security patches (techcrunch.com). Because Schwartz argues manual patching will not scale, the 2026-10-28 article points toward automated patch and exposure management.
- No fixed versions are given in the sources, so consult official PHP and vendor advisories for patch versions and CVE details.
Relatos divergentes
- Exploitation status: The 2026-10-24 TechCrunch piece reports pre-disclosure exploitation attempts and millions of attacks (Cloudflare and Amazon, as relayed by the hosts). The 2026-10-28 TechCrunch piece provides no evidence of exploitation in the wild. The later piece is silent on the matter rather than a denial, so the earlier claims stay unconfirmed.
- Discovery: The 2026-10-24 piece says the flaws were found by human researchers in the OpenAI and Wiz "Hack the Planet" initiative, who used AI to exploit the bug, and carries a correction stating they were not discovered by an LLM. The 2026-10-28 piece describes a coordinated effort by Wiz, OpenAI, Calif and the PHP team, and quotes Schwartz saying Wiz could not have found the bugs without AI, which sits uneasily with that correction. The later piece is the more recent one and adds Calif.
- Scope and age: The earlier piece speaks of "vulnerabilities" that are decades old. The later piece specifies two critical flaws and says only one bug went unnoticed for more than a decade, so the "decades" claim is not supported for both flaws. The later piece is the more recent.
Linha do tempo
-
Two critical PHP vulnerabilities force emergency patching; Wiz CTO warns AI will accelerate bug discovery
ler a análise desta fonte ocultar
Two critical vulnerabilities in PHP, the language behind roughly 70% of websites, sent organizations scrambling to patch last week. Some took sites offline until fixes were applied. Wiz CTO of Exposure Management & AppSec Tomer Schwartz took part in the response alongside OpenAI, the research group Calif and the PHP team. He says Wiz could not have found the bugs without AI, using custom tooling to test dozens of ideas over a weekend. He also says one bug sat unnoticed for more than a decade, and that AI is speeding up both the discovery and exploitation of novel vulnerabilities. The article is a podcast promotion and gives no CVE IDs, affected versions, IOCs or exploitation details.
Technical Details
- Two critical PHP bugs were disclosed and patched; the article does not name the flaw types or the CVEs.
- One bug reportedly remained undetected for more than a decade before AI-assisted research made it discoverable and exploitable.
- Schwartz says leaks are almost inherent to coordinated disclosure, and that Wiz planned for this.
- Some systems remain unpatched. The episode addresses whether WordPress site owners are at risk, but the article gives no answer.
Remediation
- Apply the latest PHP security patches. Specific fixed versions are not given in the article.
- Schwartz argues that manual patching will not scale, which points to automated patch and exposure management.
-
Two critical PHP vulnerabilities (PHP2Shell) force emergency patching; Wiz CTO warns AI will accelerate vulnerability discovery
ler a análise desta fonte ocultar
Last week, two critical vulnerabilities in PHP, the language behind roughly 70% of websites, forced organizations into emergency patching, and some took sites offline until fixes were applied. The flaws, referred to as PHP2Shell, were handled in a coordinated effort by Wiz, OpenAI, the research group Calif and the PHP team. In a TechCrunch Equity podcast episode, Tomer Schwartz, CTO of Exposure Management & AppSec at Wiz, argues that AI is shortening the time needed to discover and exploit novel vulnerabilities, and that manual patching will not scale. The article does not provide CVE identifiers, affected versions, technical details or evidence of exploitation in the wild.
-
Mass exploitation attempts follow disclosure of decades-old PHP vulnerabilities, with urgent patch-or-take-offline guidance
ler a análise desta fonte ocultar
Newly disclosed, long-standing vulnerabilities in the open source language PHP triggered an urgent warning that site owners must patch immediately or take sites offline. The article is a TechCrunch Equity podcast discussion, not primary research. It reports that the flaws were found by human researchers in the OpenAI and Wiz "Hack the Planet" initiative, who used AI to exploit the bug. A correction in the article states they were not discovered by an LLM. Reportedly, some parties got ahead of the embargo, setting off a race among attackers. Cloudflare CEO Matthew Prince described escalation to millions of attempted attacks involving "PHP2Shell", and Amazon said its honeypot network saw exploitation attempts before public disclosure. Some governments and popular websites reportedly went offline to remediate.
Technical Details
- The flaws reportedly affect PHP, which underpins CMSs such as WordPress and Drupal and, per the hosts, roughly 70% of websites.
- The article says the vulnerability has existed for decades. It gives no CVE IDs, affected versions or exploit mechanics.
- Exploitation attempts reportedly began before the public announcement (Amazon honeypot telemetry) and scaled to millions of attempts (Matthew Prince, per the hosts).
Remediation
- Per the announcement as described, patch PHP immediately.
- If patching is not possible right away, take the affected sites offline.
- The article gives no specific patch versions, so consult official PHP and vendor advisories.