While I have been chasing around today, trying to resolve this on different servers, it turns out a three line nginx mitigation (blocking multipart uploads) I wrote in the wee small hours GMT has been quietly protecting a vulnerable machine I could not shut down (from attacks powered by every single mainstream agentic AI tool — Anthropic, OpenAI, Qwen cloud, Baidu, seemingly also AWS, Meta)

Including an hour before the PHP patch actually shipped.

So without the HN discussion I wouldn't have found enough people pointing at possible mitigations and I would have lost a server to this, and I thank everyone who pointed out that second mitigation in particular.

As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video.

This is the most surprising part to me. It sounds like Calif saw the leaks, interpreted that as embargo being broken, and then raced to publish their [anime dancing] marketing video? I'd have expected much better.

For example, when I buy something from a webshop, why does that webshop need my personal information? Why can't I give it a token, which it can then use to send my package, because only the postal system knows the address coupled to the token, etc.

And we should also ban user tracking for advertising purposes, obviously.

Calif, one of the security firms that had reported the issues mistakenly published a video.

Chainguard unilaterally broke the embargo and published built images ...

Won't be the last time this happens. If there is no consequence of breaking the rules, people will keep doing that.

PHP 8.2.35 - https://smackernews.com/item/50180873 HN - Oct 2026 (439 comments)

PHP2Shell: AI uncovers critical RCE in PHP - https://smackernews.com/item/50180836 HN - Oct 2026 (146 comments)

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) - https://smackernews.com/item/50176077 HN - Oct 2026 (61 comments)

Security advisory: Critical remote code execution vulnerabilities, update now - https://smackernews.com/item/50172041 HN - Oct 2026 (631 comments)

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming - https://smackernews.com/item/50167754 HN - Oct 2026 (60 comments)

If a video is released showcasing the exploit and following mitigation recommendation, PHP should clarify what it is and if the mitigations are recommended or not. From the pre-announcement: > We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

If no info is released by them, no other party should have released anything. If info is released or leaked from partners or involved parties, you should notify and explain what's going on.

But no, complete silence from PHP news or any PHP community member.

I get that it was a complicated situation, and I think PHP is the "less wrong" party involved, but I think this constructive and external criticism could help in the future. It has been an interesting day (GMT+2 here) and a rollercoaster of monitoring and mitigating without any reliable source.

2024, PHP underwent its first external security audit

PHP security team, operating on consensus, struggled to choose

What an unfortunate waste of a security audit. (and consensus is an obvious flaw in decision making)

PHP runs a large share of the web... Yet security work on PHP itself still depends on a small group ...

Another unfortunate big structural issue that's unlikely to change.

Are there structurally much safer ecosystems out there?

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.

This is incredibly damming of Chainguard. I struggle to see justification for this, even with the chaos approaching the coordinated release.

AI has humbled most software devs, myself included, but at least with a low LOC count, a small number of dependencies and good separation of concerns, rectifying the issues is trivial. Can be done for the entire project in a couple of days.

For my own projects, each module has a clear attack surface and comfortably fits in the context window.

The scenario you want to avoid now is multiple modules interacting together in a complex way where each module is secure independently, but their shared responsibilities (improper separation of concerns) creates a gap which can be exploited. This was one of the key points from the recent Anthropic security article which stood out to me. The reason it's so dangerous is because it's difficult to get the AI to reliably analyze complex interactions between different modules as there can be many permutations. The boundaries are much simpler, more auditable and easier to patch if the module has clear responsibilities.

PHP2Shell: AI uncovers critical RCE in PHP

https://smackernews.com/item/50180836 HN

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

https://smackernews.com/item/50181175 HN

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

https://smackernews.com/item/50172041 HN

In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit ...

Well that's your problem right there! There are trillion dollar companies profiting off the back of open source projects without supporting the projects adequately. Why should they be scraping for funding for basic table stakes like audits?

The PHP security team closely monitored and inspected appearing PoCs after the leak but did not identify any functional exploits at the time of release/public disclosure

Okay, but how close did they get? Were they close enough that a determined actor could've (perhaps using an LLM) managed to get to a functioning exploit?

A nice article on the topic: https://blog.tux.org.il/php-security-october-2026.php

https://bsky.app/profile/luciferslexicon.bsky.social/post/3m...

https://en.wikipedia.org/wiki/PHP

Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos

Any info on whether Mythos missed this?

for legacy systems, how difficult would it be for an attacker assisted by "AI" to stage the conditions

on a scale of 1 (easiest) to 10 (hardest)

The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice.

This is the real story. You ship one of them (the breaking change) with —fuck-my-shit-up or something as a compile time option to switch to the other fix.

Having managed applications/servers using PHP in the past. I am so glad to be done with that dumpster fire of an ecosystem.

On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.

This was partly me. I take responsibility for posting it on HN. I am truly sorry for the disruption this has likely caused.

My contact had informed me there was no embargo, and told me her contact had told her the same. It transpired this morning that was a lie.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

On the plus side, at least I'm not Chainguard. Yikes.

It sounds cliche but yes, they should rewrite PHP in rust or other memory safe language.

There's no need for that many web languages, programming language is not a relevant factor anymore and even it was nobody can seriously argue that writing PHP "makes their heart sing" or some shit.

Chainguard unilaterally broke the embargo and published built images containing the fix.

This disregarded weeks of work by many parties toward a coordinated disclosure.

Good. Coordinated disclosure meant that people couldn't protect themselves. That's not a good thing. It meant sites were forced to shut down instead of simply updating.