The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Why do it this way? I’m genuinely unaware.
With the plex2shell, they fixed it in a previous update, then told us later.
If PHP knows what the problem is, why announce it now, and then release the patch. Why not release the patch, say hey guys this is an important one, and then tell the world/every script kiddie who didn’t know about php2shell AFTER everyone is patched?
Like I get it, I guess, php2shell must already be happening, the vulnerability is already there, but like… Shut up about it? Right? Let more people patch before you announce why the patch exists?
I’m new to this world so maybe this is normal?
They originally tried to keep it secret but it got leaked. Initial reports were only that CVSS was 9.2 and it was a permissionless remote code execution exploit. After it got leaked what the exploit was, they gave up.
Plex is a closed source software, so it’s easier to just push an update and tell about this later. PHP is open source, so if they release a patch for it, you can immediately look up in the source code and find out what has been fixed and kind of reverse engineer what the problem could be.
As this is a very high-class vulnerability, I assume that it’s very easy to get into this so if you see the patch, it’s probably trivial to just find out what the issue is and immediately start attacking everyone. With this, at least most admins are ready and can plan in that on this time they should check into the issue and patch asap.
Ah that makes more sense, that’s the key I was missing, thank you
Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.
It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.
My guess is releasing these CVEs the normal way could have catastrophic consequences. They’re giving stsadmins a heads up so there is less of a scramble when sysadmins read “hey fix your shit it’s totally vulnerable” before they have their coffee.
Like as a sysadmin, this is a great way for them to do this.
I will in 10 mins alert my team that the whole site has to come offline for a period today. I don’t need to take it offline in an emergency and tell my boss to send out a memo.
I wonder how many docker containers keep their own version of PHP…
I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.
The manual fix is relatively easy, just change a few configs.