Upcoming critical PHP security release

Gigachad

The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic. I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.

ChrisArchitect

Some more discussion: https://news.ycombinator.com/item?id=50171528

jamesfinlayson

No hints as to what versions are affected?

jacquesm

A lot of people are going to be up late on account of this.

LoganDark

There is allegedly a temporary mitigation: https://twitter.com/k_firsov/status/2112718728232329240 php.ini: session.upload_progress.enabled = Off

joshuat

If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.

bakugo

Strange to see this so far down the front page. If the rumors are true, it may be worse than Log4Shell.

atymic

Uh oh, POC is already out there https://jackalsyn.com/posts/php-up-2026.html

redox99

The exploit is already out. Yeah this looks like it's going to go on history as the worst vulnerability ever. And now with LLMs you'll likely see tens of thousands of agents hacking any php website out there within hours.

dangoodmanUT

That is definitely very not good. I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building but this time it's php directly? that's scary

nullbio

https://x.com/J4ck3LSyN/status/2112703096443097263 Already being exploited. They need to release the patch now, not later. This is already being deployed by attackers as we speak.

hparadiz

They need to release it now.

enews01

Just shut down our MediaWiki site temporarily out of an abundance of caution. The twitter videos look scary...

jeffbee

I am seeing a lot of words like "unconditional" thrown around but I remind that defense in depth is a thing and you can practice it, or should have been practicing it. You can, for example, disable the `system` function of PHP altogether. You can also arrange for your PHP to be running in a situation where there's no shell, or any other program, to exec. Or for that matter a filesystem.

charcircuit

How is the patch still not out yet? This is another case of big tech players all colluding together leaving all the small guys out to dry. At least this time we can have LLMs rediscover it and make patches ourselves. Here is the patch I had an LLM come up with against master: https://pastebin.com/raw/EUCF0SR0 It at least stops the PoC which is better than nothing.

bwoebi

For everyone wondering why the patch is not out yet: There are a handful people responsible for doing a release. They are still asleep. To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...

barelysapient

This might be the nail in the coffin for php.

dawnerd

I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.

redox99

Only 53 comments for what's most likely going to be the biggest vulnerability in history? I don't understand how this isn't getting more attention. The exploit is already out and it's basically shell access on any php website out there.

xyst

PHP is truly a garbage ecosystem. I thought log4shell was bad but this is 100X worse. With vibe coded slop tools readily available, using php in 2026 is just laziness.