‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
😭9🤣5👍4
‼️BREAKING: Security firm Calif appears to have a working exploit for the leaked PHP flaws, hours before the patch.
A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real.
A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable.
Admins have two stopgaps until the fix lands at 14:00 UTC today.
Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars.
Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads.
Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP."
If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do.
"I sadly know too much," she wrote.
A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real.
A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable.
Admins have two stopgaps until the fix lands at 14:00 UTC today.
Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars.
Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads.
Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP."
If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do.
"I sadly know too much," she wrote.
👍6
PHP: Originally created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland's central government have pulled websites offline ahead of the PHP patch.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
🙏2🥴1
‼️ PHP UPDATE: 4chan has gone read-only and Something Awful has shut its forums as American sites brace for the PHP patch.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
🔥6
‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
🔥8❤2😱1
‼️ WhiteDate, the neo-Nazi dating site German Pink Power Ranger hacker "Martha Root" wiped on stage, now forwards to GoebbelSuite, a Google parody built on the AfD leak.
https://goebbelsuite.com
https://goebbelsuite.com
🤣25🔥5🤬2👏1
🚨 The AI gateway library LiteLLM was hijacked again in a supply chain attack.
It hid malware that runs whenever Python starts and steals SSH keys, cloud secrets and Claude Code configs.
It also raids LiteLLM's own database for every AI provider key stored.
https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
It hid malware that runs whenever Python starts and steals SSH keys, cloud secrets and Claude Code configs.
It also raids LiteLLM's own database for every AI provider key stored.
https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
💩8😁1