Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #19617 > unrolled thread

PHP Releases Urgent Fixes For Two Dangerous Flaws

Back to article view | Back to comp.lang.php

Contents

  PHP Releases Urgent Fixes For Two Dangerous Flaws "Internetado" <internetado@bbs.alt119.net> - 2026-10-22 13:36 -0300
    Re: PHP Releases Urgent Fixes For Two Dangerous Flaws "J.O. Aho" <user@example.net> - 2026-10-24 11:30 +0200
      Re: PHP Releases Urgent Fixes For Two Dangerous Flaws Arno Welzel <usenet@arnowelzel.de> - 2026-10-27 09:13 +0100
        Re: PHP Releases Urgent Fixes For Two Dangerous Flaws "J.O. Aho" <user@example.net> - 2026-10-27 12:24 +0100

#19617 — PHP Releases Urgent Fixes For Two Dangerous Flaws

The PHP project asks administrators to update their servers after the 
discovery of two vulnerabilities that can lead to remote code 
execution. The alert concerns a language very present on the Web, but 
the 70% figure mentioned in the press does not correspond to the number 
of sites actually vulnerable.

L'article PHP Releases Urgent Fixes For Two Dangerous Flaws est apparu 
en premier sur Cointribune.

https://www.cointribune.com/en/php-releases-urgent-fixes-for-two-dangerous-flaws/
-- 
Eduardo.M

[toc] | [next] | [standalone]

#19618

On 22/10/2026 18.36, Internetado wrote:
> 
> The PHP project asks administrators to update their servers after the 
> discovery of two vulnerabilities that can lead to remote code execution. 
> The alert concerns a language very present on the Web, but the 70% 
> figure mentioned in the press does not correspond to the number of sites 
> actually vulnerable.
The big issue with PHPSHELL is that there are many companies and private 
persons who do not have a patching security vulnerability action plan, 
they are unaware of flaws that can compromise their systems, they do not 
even have a patch strategy, they may patch once in a while on a whim and 
if they encountered problems during a upgrade they may just think 
stability is more important than trying to solve an issue after an update.

I bet countries like dprk, ccp China, russia, iran, and pakistan are 
gleefully happy when they can hack and take over more machines for their 
bot networks.

-- 
  //Aho

[toc] | [prev] | [next] | [standalone]

#19619

J.O. Aho, 2026-10-24 11:30:

> On 22/10/2026 18.36, Internetado wrote:
>>
>> The PHP project asks administrators to update their servers after the 
>> discovery of two vulnerabilities that can lead to remote code execution. 
>> The alert concerns a language very present on the Web, but the 70% 
>> figure mentioned in the press does not correspond to the number of sites 
>> actually vulnerable.
> The big issue with PHPSHELL is that there are many companies and private 
> persons who do not have a patching security vulnerability action plan, 
> they are unaware of flaws that can compromise their systems, they do not 
> even have a patch strategy, they may patch once in a while on a whim and 
> if they encountered problems during a upgrade they may just think 
> stability is more important than trying to solve an issue after an update.
> 
> I bet countries like dprk, ccp China, russia, iran, and pakistan are 
> gleefully happy when they can hack and take over more machines for their 
> bot networks.

We will see many more vulnerabilities like this in the future, since AI
tools makes it much easier to do analysis which would take weeks or
months otherwise.

Next victim: the Brotli decoder invented by Google which is available
for Node.js and many other environments:

<https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/>


-- 
Arno Welzel
https://arnowelzel.de

[toc] | [prev] | [next] | [standalone]

#19620

On 27/10/2026 09.13, Arno Welzel wrote:

> We will see many more vulnerabilities like this in the future, since AI
> tools makes it much easier to do analysis which would take weeks or
> months otherwise.

The LLMs are getting better on it, far better than before when they just 
hallucinated a lot of issues.

> Next victim: the Brotli decoder invented by Google which is available
> for Node.js and many other environments:
> 
> <https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/>

yeah, that came a bit of as a topping on the cake.


Let see what next week will bring us.

-- 
  //Aho

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web