StoryFirst seen
The NSA has urged companies to take websites offline if they cannot patch right away, which signals how serious the risk has become.
Everything it touches
14 names 6 voices 7 source posts
The story’s neighborhood
Explore the graph, or choose a connection below.
Follow the evidence
This brief comes from Tech Twitter’s edited headlines. The posts below are the sources grouped with the story; statements in them belong to their authors.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.Read original on X
The NSA just told companies to pull their websites offline if they can't patch them right away. The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last Friday a guy found it in one evening by typing five words into an AI. Those five words were "find bad vulnerabilities in PHP." He's Dan Lorenc, CEO of a security company called Chainguard, and all he had going in was a rumor that something big was coming in PHP. A small firm called Calif had already found the same flaw back on August 1 using OpenAI's GPT-5.6 Sol. Wiz, the security company Google bought, found it on its own less than three weeks later with Gemini and GPT. Since then OpenAI, Wiz, Calif and PHP's maintainers have been quietly building a fix that Lorenc himself called "crazy." You'd think…Read original on X
THE INTERNET IS BEING PURGED. “Millions” of exploit attempts are happening as we speak, most of them, likely automated by AI agents (not all of them succeed) this is orders of magnitude bigger than the Hugging Face incident, or any other incidents for that matter.Read original on X
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits. the PHP Foundation revealed this JUST yesterday. keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.Read original on X
I cannot remember any single day with SO MANY critical security breaches / disclosures, which would impact so many sites/companies/users And have to admit that the two big labs (and especially Ant) has been warning of THIS type of thing happening, since Mythos announcementRead original on X
Just to summarize what happened so you don’t feel overwhelmed: – PHP2Shell Two memory-corruption bugs in PHP core give unauthenticated remote code execution (CVSS v4 9.2). They affect every version of the last decade, back to 5.4. The embargo leaked, attacks began before the patch, and govt sites went offline, including the UK NCSC. The NSA says patch or pull PHP systems offline. – Railway breach Railway detected unauthorized access to the systems that store customer environment variables. Attackers may have decrypted some of them: API keys, database credentials and private registry credentials. – LiteLLM supply chain attack Stolen maintainer tokens were used to push a trojanized release to PyPI, Docker Hub and GHCR. It steals cloud, SSH and AI keys and installs a backdoor. – Node.js…Read original on X
This is serious. I just saw with my very own eyes that even non-technical people can exploit CVEs like PHP2Shell using certain AI models and I am actually frightened. Once you figure it out, it is downright trivial to do. The digital infrastructure of the world is at risk.Read original on X
Cloudflare sees exploit attempts on PHP flaw climb into the millions
Cloudflare logs PHP flaw exploit attempts rising into the millions
Attempts to exploit a PHP flaw jump to millions within hours
Attempts to exploit a PHP flaw surge to millions within hours
Exploit attempts on a PHP flaw climb to millions within hours
Cloudflare sees exploit attempts on a PHP flaw jump to millions
Cloudflare sees millions of php2shell exploit attempts after disclosure
Shared connections
The company serves roughly half of U.S. hospitals and physicians, so the exposure could reach many patients.
An automated check now blocks risky actions instead of asking users to approve each step.
Testers found some internal coding agent traffic went unmonitored, and OpenAI says the findings strengthened its safeguards.
The campaign shows autonomous AI agents can run attacks against hundreds of financial targets at once.