PHP rushes out emergency fixes for critical flaws threatening millions of websites

PHP rushes out emergency fixes for critical flaws threatening millions of websites

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page gb/news/computing/news-2026-security-php-emergency-patches-for-critical-flaws, snapshot 20261026T071149Z. Copied byte for byte; every file's sha256 is in captures/20261026T071149Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Computing (UK, English), undated in the capture but written the day after disclosure (it says 'yesterday we all heard about it'), so probably 22 October: PHP rushes out emergency fixes as governments and major organisations pull sites offline. It says the NSA warned that sites unable to patch at once should be taken offline, that Cloudflare saw thousands of exploitation attempts in the ten hours before disclosure and millions since, and that Oxford City Council, Edinburgh City Council and the Office for Budget Responsibility took sites down pre-emptively. It adds that PHP core developer Gina Peter Banyard warned mitigations alone cannot fully prevent attacks, that Calif used GPT-5.6 Sol (per OpenAI) and Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and quotes Red Helix, Sophos and Adaptavist commentators.

> According to Cloudflare, in the 10 hours before they became public knowledge, there were thousands of attempts to exploit these vulnerabilities.

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP rushes out emergency fixes for critical flaws threatening millions of websites". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language en. Nothing in the page addresses an AI or hides text from a reader.