Watch the video, transcript and sources
+ PHP fixes shipped, 8.2 to 8.5
- Embargo leaked before release
- GitLab: critical RCE patched
- Meta: $25B penaltyA security embargo is supposed to keep a bug quiet until the patch ships. Amazon logged an attempt against PHP's critical bug four days early. And the company blamed for the leak has a defense I did not expect. I will get to it. PHP is a scripting language that builds web pages on the server just before they reach you. It is over thirty years old and, by one estimate, runs about seventy percent of websites, including WordPress and the software behind Wikipedia. Developers love to mock it, usually from a page PHP is serving them. Its upkeep is a nonprofit with about thirteen engineers.
On Wednesday, PHP shipped emergency fixes for two critical flaws that let a stranger run code on a server with no login. Together they are called PHP2Shell, and they reach back to PHP five point four. Here is the first bug in plain words. PHP gives every request a memory budget. If a request hits that limit at exactly the wrong moment, PHP bails out in a hurry and leaves the request half built. Then the cleanup step trusts the half-built thing. The second bug is a leftover. A fatal error can leave a note pointing at memory that belonged to the last request. The same worker handles the next request and follows the note. By then somebody else lives at that address.
On Apache with mod PHP, the damage happens before your own code runs, so your login page never gets a vote. Wiz says even a hello world script is exposed. The fix removes PHP's emergency exit for running out of memory. Instead of bailing out mid-request, PHP now stops politely at the next safe point. The odd part is how old the first clue is. In 2024, an outside security audit led a PHP core developer to the first signs of the memory problem. No exploit was known, and every fix broke something. A team that decides by consensus could not choose, so the bug waited.
Then in August, finders arrived within days. Calif researcher Ryan Austin found it on August first, working through OpenAI's Patch the Planet program. OpenAI reported the same root cause independently. Wiz found variants a few weeks later with Gemini and GPT models. Austin says he used models anyone can get, plus a theory about where PHP's old bugs hide. OpenAI says frontier AI was the key. The bug had hidden for more than a decade. The release was planned for Thursday. On Tuesday, the two CVE numbers began circulating online, with a wrong release time and a wrong score of ten. PHP pulled the release forward a day.
That evening, Calif accidentally published a video of its proof of concept working, and copies outlived the deletion. On Wednesday morning, more than six hours before the release, Chainguard published built images containing the fix. PHP says any attacker could study that fix while everyone else waited. A patch is also a diff, and attackers read diffs. So who is actually being hit? Amazon's honeypot logged an attempt on October seventeenth and later said PHP2Shell is broadly exploited. watchTowr reports exploitation in the wild. Cisa said it had not observed any when it published, and PHP's team saw no working exploit at release.
Cloudflare's CEO said it saw thousands of attempts in the ten hours before the announcement, and millions by Thursday morning. Amazon is careful on one point. It does not know whether its earliest attempts would have worked on a real system. An attempt is only a knock on the door. So how bad is it, really? watchTowr says the public exploits flying around mostly crash or do nothing. VulnCheck says code execution works in some setups, and none of the public ones beat memory randomization on standard x86 servers. Researcher Elias Taylor says it is nowhere near as easy as Log4Shell. Everyone still says patch. Governments did not wait for the verdict. The NSA told organizations that could not patch to take PHP systems offline, and the UK's National Cyber Security Centre gave similar advice. Dutch sites, including the national digital identity service, went dark, along with a Paris police site.
Wikimedia took several systems down as a precaution. Palo Alto Networks counted more than twenty two million exposed instances. And an Australian professor made the sharpest point. The sites to worry about are the ones not down today. Fixes exist for PHP eight point two through eight point five. For seven point four, eight point oh and eight point one, PHP published source patches only. Older versions get nothing from the PHP project, so ask your distribution. Workarounds shrink the odds, but PHP says updating is the only complete fix. It is the same lesson as yesterday's eMudhra episode, because a fix existing is not the same as the running process having it. Find every PHP in your stack, even the copies hiding inside other software. Update, restart the workers, and check logs back to October seventeenth.
The same day, GitLab shipped a critical patch release, nineteen point five point one. An integer overflow in its regular expression compiler lets an unauthenticated user run code on the server, and it scores ten out of ten. GitLab dot com is already patched. Self-managed installs need the update. Meanwhile in New Mexico, a judge ordered Meta to pay twenty five billion dollars in penalties over Cambridge Analytica. The jury counted more than forty three million violations at up to five thousand dollars each, which came to about two hundred twenty billion before the judge cut it. Meta says it will win on appeal. Now the defense I promised. Chainguard's CEO told The Register he found the same bugs himself on a Friday night, after learning something was coming in PHP, with a basic prompt to find bad vulnerabilities. He says he shipped early because people were already getting hit.
Verdict: SHIP IT — Ship the PHP update tonight. The new version is the only complete fix.
Sources
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://www.php.net/archive/2026.php
https://github.com/php/php-src/releases
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
https://calif.io/php2shell/
https://www.wiz.io/blog/php2shell-php-rce
https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns
https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world
https://www.bbc.com/news/articles/c3qjnwye0ep5o
https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/
https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619
https://eliastaylor.com/noexploit/
https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released
https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-entire-web-at-risk/5304611
https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
https://news.ycombinator.com/item?id=50167754
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.