ABOUT THIS EPISODE
Two bugs in PHP itself are being called "70% of the internet is affected", and the bug is serious, but the headline number is not. Here is what actually happened, where the 70% comes from, why so many sites are stuck without a fix, and what to do about it. PHP versions with the fix: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
🔗 Links
✅ Wiz, "PHP2Shell": https://www.wiz.io/blog/php2shell-php-rce
✅ PHP security advisory (21 October): https://www.php.net/archive/2026.php#2026-10-21-5
✅ PHP supported versions: https://www.php.net/supported-versions.php
✅ The Hacker News: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
✅ Huntress: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
✅ watchTowr: https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
✅ Patchstack: https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/
✅ Cloudflare rules available to all customers (Help Net Security): https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
✅ W3Techs, PHP usage: https://w3techs.com/technologies/details/pl-php
✅ W3Techs, PHP 8 subversions: https://w3techs.com/technologies/details/pl-php/8
✅ W3Techs, WordPress share of all websites: https://w3techs.com/technologies/overview/content_management
✅ Ubuntu security notice for PHP 8.1: https://ubuntu.com/security/notices/USN-8948-1
⌚ Timestamps
00:00 - Introduction
1:05 - What actually happened: two bugs in PHP itself
2:54 - Why it is such a big deal
4:33 - How your server runs PHP
5:44 - So is 70% of the internet affected?
6:56 - The real problem: old PHP with no fix
8:58 - Most people don't control their own PHP version
9:30 - Attacks, break-ins and who is going offline
11:23 - What you should do
