DevelopingTech
PHP emergency patches over PHP2Shell exploit
PHP released emergency patches for two critical AI-found remote code execution flaws, covering only PHP 8.2 and newer. Exploitation began October 17, taking government, school, hospital and bank sites offline across Europe, Japan and Kenya. Russia's FSB ordered unpatched critical sites offline, the FBI urged operators to patch immediately, Japan is setting up an AI cyberattack-simulation team, and Sam Altman and an Anthropic executive warn such disruptions will worsen.
- Developments
- 15
- Outlets
- 12
- Followed since
- 21 Oct
The Guardian · WorldFri 23 Oct · 18:48 UTC
‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking After the discovery of a…
Developments
Friday 23 October
3 developments21:40 UTC· the latest
FBI warns of two critical PHP flaws
The FBI warned that two critical PHP security flaws could let attackers breach websites, steal data and disrupt business, and urged operators to install updates immediately.
1 sourceInsider Paper
Insider PaperTelegramFri 23 Oct, 21:40
FBI warns of two critical security flaws in PHP that could allow attackers to breach websites, steal sensitive information and disrupt business operations. Urges website operators to install security updates immediately.
The original post
17:00 UTC
Altman and Anthropic exec warn AI hacking disruptions will worsen
Altman said he no longer thinks all bugs can be patched, and an Anthropic executive said mass disruptions like this week's will 'get a lot worse before they get better'.
2 sourcesBloomberg, The Guardian · World
BloombergBlueskyFri 23 Oct, 17:00
Mass cybersecurity disruptions, such as this week’s scramble by governments and companies to patch two critical software flaws, are about to “get a lot worse before they get better,” a top executive at Anthropic has warned Mass cybersecurity disruptions, such as this week’s scra
The original postThe Guardian · WorldRSSFri 23 Oct, 18:48
‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking After the discovery of a severe bug in the PHP programming language, executives warned of a coming ‘vulnerability tsunami’Leaders in cybersecurity are sounding the alarm after the discovery
The original post
08:50 UTC
Japan to set up AI cyberattack simulation team after PHP flaws
The team will use AI to find weaknesses in technology systems as organisations scramble to contain the PHP risks.
TokyoJP
1 sourceReuters
ReutersBlueskyFri 23 Oct, 08:50
Japan to simulate cyberattacks as PHP flaws roil global internet Japan said it will set up a team to simulate cyberattacks using AI to identify weaknesses in technology systems as organisations scramble to curtail risks from flaws in the PHP programming language that underpins
The original post
Thursday 22 October
5 developments20:00 UTC
FSB orders critical-infrastructure websites offline over PHP flaws
Russia's National Coordination Centre for Computer Incidents told operators on October 22 to shut sites that can't be patched quickly; RBC saw the directive.
MoscowRU
2 sourcesMeduza
MeduzaTelegramFri 23 Oct, 09:02RU
ФСБ велела отключить сайты критической инфраструктуры России из-за [уязвимостей]( в языке программирования PHP Центр кибер
The original postMeduzaRSSFri 23 Oct, 11:17
FSB orders Russian critical infrastructure websites taken offline over PHP vulnerabilities Russia’s Federal Security Service’s cybersecurity center has ordered organizations that run the country’s critical information infrastructure to temporarily shut down their websites if the
The original post
11:35 UTC
Kenyan and Dutch sites offline as UK flags cyber issue
Governments and businesses in Kenya and the Netherlands took sites offline to fend off PHP exploits, the NYT reports. Downing Street separately said some UK government services may be temporarily offline due to a cyber-security issue.
2 sourcesBBC Breaking, The New York Times
BBC BreakingXThu 22 Oct, 11:35
Some UK government services may be offline temporarily due to cyber-security issue, Downing Street says
The original postThe New York TimesRSSThu 22 Oct, 11:48
Global Rush to Fix PHP Security Flaw Leaves Some Websites Offline Governments and businesses in Kenya, the Netherlands and elsewhere were scrambling to prevent hackers from exploiting a vulnerability in PHP, a widely used programming language.
The original post
05:10 UTC
Cloudflare sees millions of PHP exploit attempts after disclosure
Cloudflare CEO Matthew Prince said the firm saw millions of exploitation attempts after the PHP vulnerabilities were disclosed.
1 sourceReuters
ReutersBlueskyThu 22 Oct, 05:10
Cloudflare sees millions of exploit attempts after PHP disclosure Cloud services firm Cloudflare saw millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X la
The original post
02:24 UTC
AWS: PHP2Shell bugs exploited days before disclosure
Amazon Web Services logged attempts to exploit the PHP flaws from October 17, four days before public disclosure, and says they are now being broadly exploited across the internet.
2 sourcesWIRED, Techmeme
WIREDRSSThu 22 Oct, 02:24
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
The original postTechmemeRSSThu 22 Oct, 02:50
AWS analysts claim that at least one actor started to exploit the PHP2Shell bugs on October 17, four days prior to the vulnerabilities' public disclosure (Lily Hay Newman/Wired) Lily Hay Newman / Wired: AWS analysts claim that at least one actor started to exploit the PHP2Shell
The original post
00:32 UTC
Japanese bank, business and ministry sites halted over PHP flaws
Websites of banks, businesses and ministries in Japan were halted after the PHP vulnerabilities were announced, as authorities urged administrators to update immediately.
1 sourceThe Japan Times
The Japan TimesRSSThu 22 Oct, 00:32
Bank, business and ministry websites halted after PHP vulnerabilities announced International authorities have urged site administrators to immediately update software to prevent unauthorized access and potential data exposure.
The original post
Wednesday 21 October
7 developments23:03 UTC
Internet Archive founder says site faced attacks after PHP disclosure
Brewster Kahle said the Internet Archive was hit by cyberattacks shortly after the flaws were disclosed; his team used Claude AI to build fixes for older PHP versions.
1 sourceInsider Paper
Insider PaperTelegramWed 21 Oct, 23:03
BREAKING: Internet Archive founder Brewster Kahle says the platform faced cyberattacks shortly after PHP security flaws were disclosed. His team used Claude AI to develop fixes for older PHP versions and local AI models to simulate attacks.
The original post
23:00 UTC
FBI cyber division warns of critical PHP flaws
The FBI's cyber division warned about two critical vulnerabilities in PHP, the language that powers many websites and web applications.
1 sourceAssociated Press
Associated PressBlueskyWed 21 Oct, 23:00
The FBI's cyber division warned Wednesday about the discovery of two "critical vulnerabilities" in PHP, a widely used programming language that powers many websites and web applications. The FBI’s cyber division warned Wednesday about the discovery of two “critical vulnerabiliti
The original post
17:33 UTC
Internet Archive and Wikipedia hit by outages amid PHP flaws
The Internet Archive went down and Wikipedia suffered outages as the PHP vulnerabilities spread disruption.
1 sourceInsider Paper
Insider PaperTelegramWed 21 Oct, 17:33
JUST IN - Internet Archive down, Wikipedia hit by outages amid PHP issues READ: Follow @InsiderPaper for more news
The original post
17:05 UTC
PHP patches cover only version 8.2 and newer
The PHP Foundation said its fixes are limited to PHP 8.2 and later, leaving legacy deployments reliant on third-party vendors.
1 sourceTechmeme
TechmemeRSSWed 21 Oct, 17:05
The PHP Foundation says its RCE patches are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors (Wired) Wired: The PHP Foundation says its RCE patches are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vend
The original post
15:25 UTC
European public websites taken offline over PHP flaws
Reuters reports several government, school and hospital websites in Europe went offline as organisations rushed to shield themselves from the PHP vulnerabilities.
1 sourceTechmeme
TechmemeRSSWed 21 Oct, 15:25
Several government, school, and hospital websites in Europe were taken offline as organizations rush to protect themselves from two critical PHP security flaws (Reuters) Reuters: Several government, school, and hospital websites in Europe were taken offline as organizations rush
The original post
14:50 UTC
NSA urges taking unpatched PHP sites offline
The US spy agency told organisations to take websites offline if they cannot immediately fix the two critical PHP flaws.
2 sourcesInsider Paper
Insider PaperTelegramWed 21 Oct, 14:50
BREAKING: NSA issues urgent warning over two critical PHP security flaws that could put websites worldwide at risk, urging organizations to take affected systems offline if they cannot be immediately secured.
The original postInsider PaperTelegramWed 21 Oct, 15:36
BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites READ:
The original post
02:12 UTC
PHP warns of two imminent emergency patches
The project's warning follows an unconfirmed report of a PHP2Shell remote code execution exploit.
1 sourceArs Technica
Ars TechnicaRSSWed 21 Oct, 02:12
PHP warns it plans to release 2 emergency patches imminently Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
The original post
What it looked like.
Fri 23 Oct · 18:48 · The Guardian · World
‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking After the discovery of a…
Altman and Anthropic exec warn AI hacking disruptions will worsenFri 23 Oct · 17:00 · Bloomberg
Mass cybersecurity disruptions, such as this week’s scramble by governments and companies to patch two critical…
Altman and Anthropic exec warn AI hacking disruptions will worsenFri 23 Oct · 08:50 · Reuters
Japan to simulate cyberattacks as PHP flaws roil global internet Japan said it will set up a team to simulate…
Japan to set up AI cyberattack simulation team after PHP flawsThu 22 Oct · 11:48 · The New York Times
Global Rush to Fix PHP Security Flaw Leaves Some Websites Offline Governments and businesses in Kenya, the Netherlands…
Kenyan and Dutch sites offline as UK flags cyber issueThu 22 Oct · 05:10 · Reuters
Cloudflare sees millions of exploit attempts after PHP disclosure Cloud services firm Cloudflare saw millions of…
Cloudflare sees millions of PHP exploit attempts after disclosureThu 22 Oct · 00:32 · The Japan Times
Bank, business and ministry websites halted after PHP vulnerabilities announced International authorities have urged…
Japanese bank, business and ministry sites halted over PHP flawsWed 21 Oct · 23:00 · Associated Press
The FBI's cyber division warned Wednesday about the discovery of two "critical vulnerabilities" in PHP, a widely used…
FBI cyber division warns of critical PHP flawsWed 21 Oct · 17:33 · Insider Paper
JUST IN - Internet Archive down, Wikipedia hit by outages amid PHP issues READ: Follow @InsiderPaper for more news
Internet Archive and Wikipedia hit by outages amid PHP flawsWed 21 Oct · 15:36 · Insider Paper
BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious…
NSA urges taking unpatched PHP sites offlineWed 21 Oct · 14:50 · Insider Paper
BREAKING: NSA issues urgent warning over two critical PHP security flaws that could put websites worldwide at risk,…
NSA urges taking unpatched PHP sites offlineWed 21 Oct · 02:12 · Ars Technica
PHP warns it plans to release 2 emergency patches imminently Unconfirmed report claims PHP2Shell exploit remotely…
PHP warns of two imminent emergency patches