Two critical PHP vulnerabilities (PHP2Shell) force emergency patching as exploitation attempts reportedly reach millions
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 29/10/2026 00:11; os links antigos trazem para cá.
Fontes: techcrunch.com ×2 ↗
Two critical vulnerabilities in PHP, the language behind roughly 70% of websites, forced emergency patching in the week before 2026-10-28, and some organizations, including reportedly some governments and popular sites, took systems offline until fixes were applied (techcrunch.com). The flaws are referred to as PHP2Shell and were handled in a coordinated effort by Wiz, OpenAI, the research group Calif and the PHP team (techcrunch.com). An earlier report (2026-10-24) said some parties got ahead of the embargo, setting off a race among attackers. It also said Cloudflare CEO Matthew Prince described millions of attempted attacks, and that Amazon saw exploitation attempts in its honeypot network before public disclosure (techcrunch.com). A later piece (2026-10-28) gives no evidence of exploitation in the wild, so that claim is secondhand and unverified. Both sources are TechCrunch Equity podcast discussions, not primary research, and neither gives CVE identifiers, affected versions or exploit mechanics.
Entenda a falha
A vulnerabilidade
Two critical vulnerabilities in PHP, collectively called PHP2Shell, forced emergency patching in the week before 2026-10-28. Some organizations took sites offline until they could patch. The sources are TechCrunch Equity podcast discussions, not primary research. They give no CVE IDs, affected or fixed versions, vulnerable component, or attacker prerequisites. The name PHP2Shell hints at code execution, but the articles do not confirm what an attacker gets. The earlier piece says the weakness has existed for decades. PHP underpins WordPress and Drupal and, per the hosts, roughly 70% of websites.
Como funciona
The articles do not describe how the vulnerable process works. They do not say what input reaches which PHP component, what PHP does with it, or at which step it fails. Defenders should rely on the official PHP advisories and the researchers' write-ups for the mechanism.
Por que é vulnerável
The root cause is not explained. The only point made is that the flaw reportedly sat in PHP for decades without anyone knowing, which is why it went unnoticed. The articles say nothing about the bug class or about what the fix changes.
Como foi descoberta
A correction in the 2026-10-24 piece says human researchers in the OpenAI and Wiz Hack the Planet initiative found the flaws and used AI to exploit the bug. The original claim that an LLM found them was retracted. The 2026-10-28 piece describes a coordinated fix effort by Wiz, OpenAI, the research group Calif and the PHP team, with Wiz CTO Tomer Schwartz involved. The hosts say a couple of parties got ahead of the embargo, setting off a race among attackers. Amazon reportedly saw exploitation attempts in its honeypot before disclosure, and Cloudflare CEO Matthew Prince reportedly cited millions of attempts. All of this is relayed secondhand and unverified, and the later piece gives no evidence of exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 00:26.
Detalhes técnicos
- PHP underpins CMSs such as WordPress and Drupal and, per the podcast hosts, roughly 70% of websites (techcrunch.com).
- The earlier article says the vulnerability has existed for decades. It gives no CVE IDs, affected versions or exploit mechanics (techcrunch.com).
- Exploitation attempts reportedly began before the public announcement (Amazon honeypot telemetry) and escalated to millions of attempts involving "PHP2Shell" (Matthew Prince, per techcrunch.com).
- Tomer Schwartz, CTO of Exposure Management & AppSec at Wiz, argues that AI is shortening the time needed to discover and exploit novel vulnerabilities and that manual patching will not scale (techcrunch.com).
Remediação
- Patch PHP immediately. If that is not possible right away, take affected sites offline (techcrunch.com).
- No fixed versions are given in the sources, so consult official PHP and vendor advisories for patch versions and CVE details.
Relatos divergentes
- Exploitation status: The 2026-10-24 TechCrunch piece reports pre-disclosure exploitation attempts and millions of attacks (Cloudflare and Amazon, as relayed by the hosts). The 2026-10-28 TechCrunch piece provides no evidence of exploitation in the wild. The later piece is silent on the matter rather than a denial, so the earlier claims stay unconfirmed.
- Discovery: The 2026-10-24 piece says the flaws were found by human researchers in the OpenAI and Wiz "Hack the Planet" initiative, who used AI to exploit the bug, and carries a correction stating they were not discovered by an LLM. The 2026-10-28 piece describes a coordinated effort by Wiz, OpenAI, Calif and the PHP team. The later piece is the more recent one and adds Calif.
- Scope: The earlier piece speaks of "vulnerabilities" that are decades old. The later piece specifies two critical flaws and does not mention their age.
Linha do tempo
-
Two critical PHP vulnerabilities (PHP2Shell) force emergency patching; Wiz CTO warns AI will accelerate vulnerability discovery
ler a análise desta fonte ocultar
Last week, two critical vulnerabilities in PHP, the language behind roughly 70% of websites, forced organizations into emergency patching, and some took sites offline until fixes were applied. The flaws, referred to as PHP2Shell, were handled in a coordinated effort by Wiz, OpenAI, the research group Calif and the PHP team. In a TechCrunch Equity podcast episode, Tomer Schwartz, CTO of Exposure Management & AppSec at Wiz, argues that AI is shortening the time needed to discover and exploit novel vulnerabilities, and that manual patching will not scale. The article does not provide CVE identifiers, affected versions, technical details or evidence of exploitation in the wild.
-
Mass exploitation attempts follow disclosure of decades-old PHP vulnerabilities, with urgent patch-or-take-offline guidance
ler a análise desta fonte ocultar
Newly disclosed, long-standing vulnerabilities in the open source language PHP triggered an urgent warning that site owners must patch immediately or take sites offline. The article is a TechCrunch Equity podcast discussion, not primary research. It reports that the flaws were found by human researchers in the OpenAI and Wiz "Hack the Planet" initiative, who used AI to exploit the bug. A correction in the article states they were not discovered by an LLM. Reportedly, some parties got ahead of the embargo, setting off a race among attackers. Cloudflare CEO Matthew Prince described escalation to millions of attempted attacks involving "PHP2Shell", and Amazon said its honeypot network saw exploitation attempts before public disclosure. Some governments and popular websites reportedly went offline to remediate.
Technical Details
- The flaws reportedly affect PHP, which underpins CMSs such as WordPress and Drupal and, per the hosts, roughly 70% of websites.
- The article says the vulnerability has existed for decades. It gives no CVE IDs, affected versions or exploit mechanics.
- Exploitation attempts reportedly began before the public announcement (Amazon honeypot telemetry) and scaled to millions of attempts (Matthew Prince, per the hosts).
Remediation
- Per the announcement as described, patch PHP immediately.
- If patching is not possible right away, take the affected sites offline.
- The article gives no specific patch versions, so consult official PHP and vendor advisories.