PU 59: PHP2Shell

AI has found a very serious vulnerability in 70% of websites. Are we lucky here? Or will the world end because of it? In fact, AI has almost nothing to do with this story. Humans do, however.

Punching Upwards, Episode 59 for 25 October 2026

Topics: Infosec / Artificial Intelligence

🦉 No AI Content 📢 Podcast RSS Feed

Credits

Thanks to Michael Mullan-Jensen, Evgeny Kuznetsov, Vlad A Gouf, Fadi Mansour, Bennet Piater, Eric and Sir Galteran for supporting this podcast financially and therefore making it possible for me to produce it!

Sources

* A tale of two PHP remote vulnerabilities, Ryan Austin, Calif, 21 October 2026

* PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, Sagi Tzadik et al., Wiz, 21 October 2026

* Today’s PHP Security Release, and How We’re Strengthening PHP Security, The PHP Foundation, 21 October 2026

* Finding and Exploiting a 21-Year-Old Vulnerability in PHP, Ryan Austin, Calif, 1 May 2026

* PHP Audit Complete!, OSTIF, 10 April 2025

* PHP memory_limit remote vulnerability, Stefan Esser, Bugtraq, 13 July 2004

* Exploiting the php <= 4.3.7 memory_limit bug, Bas Alberts, 18 August 2004 (archived copy)

* Sicherheitsspezialist verlässt resigniert PHP-Security-Team, Daniel Bachfeld, heise online, 13 December 2006

* PHP Security Specialist (Stefan Esser) Resigns, Darknet, 18 January 2007

* Long variables in multipart/form-data cause OOM and temp files are not cleaned, jr@coredu.mp, PHP Bug Tracker, 28 November 2019

* AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack, Emily Forlini, Fortune, 21 October 2026

* AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk, Robert McMillan, The Wall Street Journal, 21 October 2026

* A.I. Discovered a Critical Security Flaw Underpinning Websites, Dustin Volz, The New York Times, 21 October 2026

* Government websites go dark after AI-discovered flaw sparks security scramble, Raphael Satter et al., Reuters, 21 October 2026

* Wichtige PHP-Updates am 21. Oktober beheben Codeeinschleusung-Schwachstellen, Dr. Christopher Kunz, heise online, 21 October 2026

* php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP, Dr. Christopher Kunz, heise online, 21 October 2026

* CVE-2026-109618, cve.org, 21 October 2026

* CVE-2026-109619, cve.org, 21 October 2026

* Security Advisory 2026-018, CERT-EU, 20 October 2026

* Version 1.2: PHP - Kritische Schwachstellen bedrohen Webanwendungen weltweit, Bundesamt für Sicherheit in der Informationstechnik, 22 October 2026

* Patch the Planet: a Daybreak initiative to support open source maintainers, OpenAI, 22 June 2026

* Websites taken down worldwide as AI reveals critical cyber-security threat, The BBC, 21 October 2026

* A flaw in PHP is taking down websites. Is the internet at risk?, The BBC, 22 October 2026

* Websites went down around the world. Did AI stop it getting worse?, The BBC, 22 October 2026

* Expert explains the PHP bug that could take down 70% of the internet, CBS News, 22 October 2026

* Websites taken down worldwide over critical PHP vulnerabilities, Deutsche Welle, 22 October 2026

* Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched, Lily Hay Newman, Wired, 21 October 2026

* Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, CJ Moses, AWS, 21 October 2026

The theme music for the podcast is a track called Fight or Fall by Def Lev. Find out more about the show at fab.industries/podcast — new media, new rules!