Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Some code example for the exploits https://github.com/david-alvarez-rosa/php-rce
    by dalvrosa
  • > 2024, PHP underwent its first external security audit

    > PHP security team, operating on consensus, struggled to choose

    What an unfortunate waste of a security audit. (and consensus is an obvious flaw in decision making)

    > PHP runs a large share of the web... Yet security work on PHP itself still depends on a small group ...

    Another unfortunate big structural issue that's unlikely to change.

    Are there structurally much safer ecosystems out there?

    by eviks
  • I think the PHP security team and the whole PHP team could have been more communicative and keep releasing information, adapting to the news, suspected exploits and mitigations.

    If a video is released showcasing the exploit and following mitigation recommendation, PHP should clarify what it is and if the mitigations are recommended or not. From the pre-announcement: > We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

    If no info is released by them, no other party should have released anything. If info is released or leaked from partners or involved parties, you should notify and explain what's going on.

    But no, complete silence from PHP news or any PHP community member.

    I get that it was a complicated situation, and I think PHP is the "less wrong" party involved, but I think this constructive and external criticism could help in the future. It has been an interesting day (GMT+2 here) and a rollercoaster of monitoring and mitigating without any reliable source.

    by jopicornell
  • Related:

    PHP 8.2.35 - https://news.ycombinator.com/item?id=50180873 - Oct 2026 (439 comments)

    PHP2Shell: AI uncovers critical RCE in PHP - https://news.ycombinator.com/item?id=50180836 - Oct 2026 (146 comments)

    PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) - https://news.ycombinator.com/item?id=50176077 - Oct 2026 (61 comments)

    Security advisory: Critical remote code execution vulnerabilities, update now - https://news.ycombinator.com/item?id=50172041 - Oct 2026 (631 comments)

    Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming - https://news.ycombinator.com/item?id=50167754 - Oct 2026 (60 comments)

    by dang
  • > Calif, one of the security firms that had reported the issues mistakenly published a video.

    > Chainguard unilaterally broke the embargo and published built images ...

    Won't be the last time this happens. If there is no consequence of breaking the rules, people will keep doing that.

    by fg137
  • > As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video.

    This is the most surprising part to me. It sounds like Calif saw the leaks, interpreted that as embargo being broken, and then raced to publish their [anime dancing] marketing video? I'd have expected much better.

    by dannyw
  • We should really move to a different security model on the internet.

    For example, when I buy something from a webshop, why does that webshop need my personal information? Why can't I give it a token, which it can then use to send my package, because only the postal system knows the address coupled to the token, etc.

    And we should also ban user tracking for advertising purposes, obviously.

    by amelius
  • You may never hear me say this again because I am a gruff cynic who is not sure that hanging out here is good for his psyche, but thank goodness for HN.

    While I have been chasing around today, trying to resolve this on different servers, it turns out a three line nginx mitigation (blocking multipart uploads) I wrote in the wee small hours GMT has been quietly protecting a vulnerable machine I could not shut down (from attacks powered by every single mainstream agentic AI tool — Anthropic, OpenAI, Qwen cloud, Baidu, seemingly also AWS, Meta)

    Including an hour before the PHP patch actually shipped.

    So without the HN discussion I wouldn't have found enough people pointing at possible mitigations and I would have lost a server to this, and I thank everyone who pointed out that second mitigation in particular.

    by dofm

Explore Birbla archives