HN

Comments (130)

• throwaway800BC
  Took a quick peak at the relevant C code and what I think are the offending lines seem somewhat suspicious right off the bat.Fil-C should have caught this right? I wonder if it would benefit the PHP ecosystem as a whole if the releases are built with it instead.
• Menu

  bwoebi
  For everyone wondering why the patch is not out yet:There are a handful people responsible for doing a release. They are still asleep.To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...
• Menu

  redox99
  The exploit is already out. Yeah this looks like it's going to go on history as the worst vulnerability ever. And now with LLMs you'll likely see tens of thousands of agents hacking any php website out there within hours.
• Menu

  throwaway82931
  I help manage a few sites hosted on WPEngine, and taking them down is not an easy call to make. After making sure that our environments had the latest everything (WordPress version, PHP version, all plugins and themes on the latest), I contacted WPEngine support briefly.They're on top of it as I would expect any major PHP hosting service to be. After asking if there was anything I could do to prep for php2shell (seemingly not), I just pleaded to be first in line when they apply patches and let them go.How are others in similar situations handling this?
• Menu

  dawnerd
  I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
• Menu

  vincent_s
  Two things you can do now:1. Turn off session upload progress2. Block multipart requests at the web serverMore info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
• joshuat
  If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.
• Menu

  Gigachad
  The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
• Menu

  sdfgsdfgsdsdfgs
  According to this https://jackalsyn.com/posts/php-up-2026.html, you need the dtor to successfully replicate the RCE on a live server.So, theoretically, if you wanted to hack a server but you don't know what OS/PHP, version they're running, you could compile a list of every delta for every litespeed release and then bruteforce it, right?
• Menu

  enews01
  Just shut down our MediaWiki site temporarily out of an abundance of caution. The twitter videos look scary...
• dl
  I suppose this will go down in history :|
• Menu

  metax
  Dumb question: does this affect a backend even if behind an ouath wall?
• Menu

  dangoodmanUT
  That is definitely very not good.I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when buildingbut this time it's php directly? that's scary
• ernubufiei
  Unsure what the correct response from the PHP team is here - I hope there's been plenty of work done behind the scenes to mitigate this on unpatched servers because there's not a chance defenders win the race everywhere it matters once the patches are out.
• jtchang
  This is going to pop a lot of wordpress sites.
• Menu

  barelysapient
  This might be the nail in the coffin for php.
• aussieguy1234
  I suspect we might be about to see a big Bitcoin mining boom...
• Menu

  atymic
  Uh oh, POC is already out there https://jackalsyn.com/posts/php-up-2026.html
• Menu

  alberth
  A user on X claims: Temporaly mitigation php.ini: session.upload_progress.enabled = Off https://x.com/k_firsov/status/2112718728232329240#mhttps://xitter.cf/k_firsov/status/2112718728232329240#m
• Menu

  jacquesm
  A lot of people are going to be up late on account of this.
• Menu

  aksss
  Rather than taking your site down tonight, if you have cloudflare handling your DNS, orangeclouding your domain, you can use its free security rules to just block all post requests until tomorrow rather than taking your whole site offline. Drop this into a rule: `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`Of course you can do this with web server (eg Apache) config as well, but the CF rule is something you can do now on your phone.I’m not saying I know this works as a mitigation, but it seems like it could at least contribute to a temporary guard until you get patch in place. Everything I’ve seen about the exploits seem to revolve around multipart form submissions.
• Menu

  LoganDark
  There is allegedly a temporary mitigation: https://twitter.com/k_firsov/status/2112718728232329240php.ini: session.upload_progress.enabled = Off
• Menu

  bakugo
  Strange to see this so far down the front page. If the rumors are true, it may be worse than Log4Shell.
• Menu

  simondotau
  Once the dust has settled, it would be interesting to give LLMs the pre-patch source code and see whether any of them can identify this chain of vulnerabilities. Even if they can't identify the full chain, can they at least spot one of the constituent bugs and recognise its seriousness?If they can't, why not?If they can, why haven't they already?
• Menu

  t1234s
  Would blocking all multipart/formdata requests be a sufficient mitigation until the updated php version is available?
• hparadiz
  They need to release it now.
• Menu

  jamesfinlayson
  No hints as to what versions are affected?
• Menu

  jeffbee
  I am seeing a lot of words like "unconditional" thrown around but I remind that defense in depth is a thing and you can practice it, or should have been practicing it. You can, for example, disable the `system` function of PHP altogether. You can also arrange for your PHP to be running in a situation where there's no shell, or any other program, to exec. Or for that matter a filesystem.
• nullbio
  https://x.com/J4ck3LSyN/status/2112703096443097263 Already being exploited. They need to release the patch now, not later. This is already being deployed by attackers as we speak.
• Menu

  redox99
  Only 53 comments for what's most likely going to be the biggest vulnerability in history? I don't understand how this isn't getting more attention. The exploit is already out and it's basically shell access on any php website out there.
• charcircuit
  How is the patch still not out yet? This is another case of big tech players all colluding together leaving all the small guys out to dry.At least this time we can have LLMs rediscover it and make patches ourselves.Here is the patch I had an LLM come up with against master: https://pastebin.com/raw/EUCF0SR0 It at least stops the PoC which is better than nothing.
• ChrisArchitect
  Some more discussion: https://news.ycombinator.com/item?id=50171528
• sdfgsdfgsdsdfgs
  [flagged]
• xyst
  PHP is truly a garbage ecosystem. I thought log4shell was bad but this is 100X worse.With vibe coded slop tools readily available, using php in 2026 is just laziness.
• Menu

  shepherdjerred
  Honest question, who uses php anymore?I know there must be a ton of random sites which makes this a huge deal.But, does it affect any big players? I think php is big at Meta but I would imagine its so heavily customized it might be safe from this.