A PHP Bug Just Took Websites Offline Worldwide

Author: Better Stack · Watch on YouTube

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: A PHP Bug Just Took Websites Offline Worldwide · Channel: Better Stack · 06:43 · Watch on YouTube

Topics: Cybersecurity and software security, Software engineering with AI

Summary

Two serious vulnerabilities in PHP, which the video says runs roughly 70% of the internet, could let attackers execute code on servers without logging in. A chaotic disclosure process and concern about delayed patching led agencies to advise taking vulnerable systems offline, and websites around the world temporarily did so. At the time of the video, security organizations had reported exploit attempts but no confirmed successful exploitation; unpatched older PHP versions remained a concern. The video argues that AI-assisted exploit development could make the time between disclosure and attacks much shorter.

Key points

The vulnerabilities are in PHP itself, so updating an application or plugin does not fix them; PHP must be updated.
The described flaw can leave partially built data behind after PHP runs out of memory, which a later request may exploit to achieve remote code execution.
Researchers demonstrated the issue on fresh installations of WordPress, Drupal, and Joomla, as well as a simple hello-world application.
The disclosure was disrupted by early posts, a mistakenly published exploit video, and patched PHP images released before the planned announcement.
The NSA, CISA, the FBI, and the UK’s NCSC advised organizations unable to patch promptly to take affected systems offline.
Websites and services that went offline included systems in the Netherlands and the UK, parts of Wikimedia, 4chan, Something Awful, and BreachForums.
Cloudflare and other providers had advance notice and prepared firewall rules; the video reports no confirmed successful exploitation at the time.
The video highlights patching older PHP versions as a challenge, while noting that PHP packages maintained for Debian and Ubuntu included fixes back to PHP 7.4.
The researchers’ accounts differed on who found the vulnerability first and how AI tools contributed; the video says the underlying bug class dates back to research from 2004.
The video warns that AI-assisted exploit development may accelerate attacks and urges viewers to update any PHP servers they operate.

Chapters

Start	Chapter	Summary
00:00	PHP vulnerabilities and their impact	The video introduces the two PHP vulnerabilities, their potential for remote code execution, and the need to update PHP itself.
01:32	A disrupted disclosure and urgent response	Early disclosures and a premature release of patched images disrupted the planned announcement, prompting warnings to patch or take systems offline.
03:35	Exploitation reports and patching challenges	The video discusses reported exploit attempts, mitigations, and the risk that older PHP servers will remain unpatched.
05:09	AI, vulnerability research, and what comes next	The video considers the history of the bug, competing accounts of how it was found, and the risk that AI will speed up exploit development.

Quotes

This is in PHP itself, so updating your app doesn’t fix this. You have to update PHP. — 00:30

if you can’t update straight away, take the system offline. — 02:35

So, has half the internet been hacked? Well, not as far as we know. — 03:35

Disclosure was built for a world where finding the bug was the hard part and I don’t think in that world anymore. — 06:12

Concepts and entities

PHP, PHP Foundation, Wiz, Cloudflare, CISA, NSA, Debian, Ubuntu, Laravel

Full transcript (original language)

00:00 The NSA and other cyber agencies across the world are telling organizations to take their websites offline if they can’t patch them. Big names like 4chan went down, parts of Wikimedia went down, and even hacker forums like BreachForums have switched themselves off. All of this because of two bugs in PHP, and PHP runs roughly 70% of the internet, so the scale of this could be massive. The researchers who found them are comparing this to Heartbleed and Log4Shell. >> [music]

00:30 >> So these two bugs are being called PHP to shell, and they went public on Wednesday with a score of 9.2 out of 10. An important thing to note here is this isn’t WordPress or some dodgy plugin like we’ve seen before. This is in PHP itself, so updating your app doesn’t fix this. You have to update PHP. The PHP Foundation’s short version of how this works is if a request runs PHP out of memory at exactly the wrong moment, PHP can leave half-built data behind and later trust it. And with the right request, that means someone on the internet can run their own code on your server without logging in. So they can

01:01 have remote code execution. The security researchers Wiz showed this exploit working against fresh installs of the latest versions of WordPress, Drupal, and Joomla, and they say this can even impact a hello world application as it’s the language itself that’s vulnerable. They say that every version of PHP from the last decade can be exploited by one of these vulnerabilities. So if you’re watching this video and you just remember that you have a PHP server set up somewhere, go ahead and update it. Also subscribe because I see about 80% of you aren’t subscribed, and it really helps us out. Now, how these two bugs were disclosed was a bit of a rocky

01:32 ride. It was meant to be a calm coordinated release. The plan was to publish everything on a Thursday. On Tuesday afternoon, the two CVE numbers got posted to Hacker News with the wrong severity, claiming they were both a perfect 10. The person who had posted this since apologized and said their source told them there was no embargo. But because of this, that evening PHP gave everyone advanced notice and pulled the release forward a day. Around the same time, Kaliff, one of the firms that found the bug, mistakenly published a video of their exploit working against real targets, and it did get deleted, but copies of it were going around

02:03 Twitter. Then on Wednesday morning, more than 6 hours before the release, Chain Guard published patched PHP images, and the PHP Foundation says that unilaterally broke the embargo, because anyone can now go study the fix while everyone else was still waiting. So, by the time the patch actually landed at 2:00 a.m. UTC, everyone already knew roughly where to look. Whatever happened to responsible disclosure? Now, obviously, people began racing to build an exploit, and since there’s a lot of servers that won’t be patched in a day, the advice got pretty drastic. The NSA, CISA, the FBI, and the UK’s NCSC all

02:35 said that if you can’t update straight away, take the system offline. Even Japan’s Prime Minister tweeted about this. As a response, we saw a wave of websites going down. In the Netherlands, DigiD, the national login service, went down, along with Parliament’s website, and even the national cybersecurity one. In the UK, Edinburgh, Bristol, and Oxford had sites go offline. Wikimedia took some systems down, and 4chan and Something Awful also went offline to wait for the patch. Levels, one of the biggest PHP fans that I follow on Twitter, disconnected every single server of his business before the patch

03:05 dropped. And one sysadmin on Reddit said it was the first time in 20 years they’d deliberately taken their website down. In a fun bit of irony as well, Breach Forums also went offline, and the moderator said they’ll stay down until PHP is patched, and we take our security seriously. I mean, yeah, I suppose the forum with all of the hackers is most likely to be hacked as well. Now, one of the reasons this might not have the scale that it could potentially have is because Cloudflare and several and a few others were told weeks in advance, so they quietly built firewall rules. Cloudflare switched theirs on for every customer at 3:00 a.m. UTC on Wednesday,

03:35 and they say they watched attackers tweet their payloads to try and get around them. So, has half the internet been hacked? Well, not as far as we know. Watchtower says they are seeing real attempts in the world using exploit tools 5 coded with AI, but in their words, nobody’s been successful to date. CISA also says it hasn’t seen successful exploitation attempts yet. So right now, the damage is mostly in the websites that people chose to switch off. But the real worry is in the long tail. Only 8.2 and newer got proper releases, and older versions got patches you have to build yourself. And one scan found that 59% of

04:06 servers show a PHP version of 8.1 and older, and that’s the stuff that probably won’t get patched this week or maybe ever. It’s worth mentioning here Andre Suri, who maintains the PHP packages a lot of Debian and Ubuntu servers pull from. Those packages had fixes all the way back to PHP 7.4, which is an absolutely awesome move. Now, another bit of chaos in this story is who actually found this bug. Open AI says Kali found this using GPT 5.6 Soul as part of Open AI’s Patch the Planet program, and that Open AI led the group that got everyone ready. They’re calling

04:37 it one of the most impactful vulnerabilities in recent memory. Wiz found this independently, and they say Gemini 4 Argon made an invaluable contribution, and it’s worth noting that Wiz is owned by Google now. Then Kali posted saying let’s set the record straight, saying their researcher was first and pointing to a tweet from August 5th as the proof. And in Kali’s write-up, they say the researcher used no special harnesses and no models that weren’t available to everyone. They picked PHP because they knew its history and had a theory about where the bugs were hiding. And what he’s referring to here is a 2024 security audit by the PHP

05:09 Foundation that already found the first signs of this exact problem, but nobody could prove it was exploitable, so the fix kept stalling. In other words, that was actually a structural failure, and they’d even scan PHP with Anthropic’s Claude Mythos earlier in the year, and that seemingly missed it, too. So what had changed this time? Well, the bug class itself goes back to a research from 2004. What changed is how far someone who knows where to look can turn an old theory into a working exploit. Wiz says one researcher did in a week what would have taken a world-class team months. And that’s the scary part. None

05:41 of this is going to slow down. On the same day, Node.js patched a remote code execution bug of its own, and GitLab shipped a fix for I’m rating a full 10 out of 10. Then on the same evening, I’ve literally just seen that Railway announced a breach. They say someone got into the systems that store customer environment variables and for some of them got decrypted values. So API keys, databases, passwords all have been leaked. Nothing links this to PHP to shell, but Railway says it looks like part of a series of attacks on platforms aimed at getting AI provider keys.

06:12 OpenAI says that PHP to shell is one of several big bugs it’s already found and it expects findings are likely to increase sharply in the coming months. Taylor Otwell, who created Laravel, put this pretty well. He said it probably won’t be the last time and PHP probably won’t be the only language that goes through it. Overall, I think the bug itself was the least interesting part of this story. The fix was ready, the CDN is ready, but it still turned into chaos because news got out a day early and because of AI, a few hours is all it needs for people with AI agents to start building exploits. Disclosure was built for a world where finding the bug was

06:43 the hard part and I don’t think in that world anymore. So if you’re on PHP anywhere, even on some server you forgot about, go ahead and update it. Let me know what you think about all of this in the comments down below or either subscribe and as always, see you in the next one. >> [music]