PHP2Shell flaws exploited before patch, taking government sites offline

Just to summarize what happened so you don’t feel overwhelmed: – PHP2Shell Two memory-corruption bugs in PHP core give unauthenticated remote code execution (CVSS v4 9.2). They affect every version of the last decade, back to 5.4. The embargo leaked, attacks began before the patch, and govt sites went offline, including the UK NCSC. The NSA says patch or pull PHP systems offline. – Railway breach Railway detected unauthorized access to the systems that store customer environment variables. Attackers may have decrypted some of them: API keys, database credentials and private registry credentials. – LiteLLM supply chain attack Stolen maintainer tokens were used to push a trojanized release to PyPI, Docker Hub and GHCR. It steals cloud, SSH and AI keys and installs a backdoor. – Node.js…

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

The NSA just told companies to pull their websites offline if they can't patch them right away. The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last Friday a guy found it in one evening by typing five words into an AI. Those five words were "find bad vulnerabilities in PHP." He's Dan Lorenc, CEO of a security company called Chainguard, and all he had going in was a rumor that something big was coming in PHP. A small firm called Calif had already found the same flaw back on August 1 using OpenAI's GPT-5.6 Sol. Wiz, the security company Google bought, found it on its own less than three weeks later with Gemini and GPT. Since then OpenAI, Wiz, Calif and PHP's maintainers have been quietly building a fix that Lorenc himself called "crazy." You'd think…

THE INTERNET IS BEING PURGED. “Millions” of exploit attempts are happening as we speak, most of them, likely automated by AI agents (not all of them succeed) this is orders of magnitude bigger than the Hugging Face incident, or any other incidents for that matter.