Hackers Are Exploiting PHP Right Now. Updating Isn't Enough | Security | AI new Era

CISA confirmed on 26 October that hackers are exploiting PHP2Shell, the two critical PHP bugs, and gave US federal agencies three days to fix them. Installing the update is not enough. Until PHP restarts, your website keeps running the old code.

PHP fixed both bugs on 21 October in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. In my lab the patched version was already on disk and the site still answered as vulnerable. This video shows why, how to check your own server in a few minutes, and what to do tonight.

In this video:

Why the old PHP process keeps serving requests after you patch

five beliefs about this bug that people shared, and why each is wrong.

A lab you can run on your own machine, loopback only

what attackers were seen trying, and what nobody has confirmed.

The list I'd work through tonight: find every PHP you run, check what each site advertises, decide on evidence first, patch with proof, restart, hunt back to 17 October, keep watching

the third issue that has no fix release yet, and the setting to change until it does

Chapters :

0:00 A website goes dark

0:48 The week everyone pulled the plug

2:50 One request, from the internet to your code

6:51 Five things people believed

9:40 The lab: check it yourself

12:20 The Bitcoin dare

14:07 Attempts, breaches, and who was knocking

16:10 The loop: check, patch, restart, hunt, watch

19:51 Back to the website that went dark

Tools from the video :

OpenAI php2shell-checker (reads what your site advertises, sends no exploit probes): https://github.com/openai/php2shell-checker

NCSC-NL PHP2Shell repository (operational information): https://github.com/NCSC-NL/php2shell

process-watcher by Florian Roth (flags a PHP worker spawning a shell): https://github.com/Neo23x0/process-watcher

Lab script from the video: https://github.com/qualixar/php2shell-lab

Sources

PHP release notes: https://www.php.net/archive/2026.php

CISA alert, 21 Oct 2026: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

OpenAI coordinated disclosure: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities

Only run scanners on systems you own or are authorised to test.

Other Sources for full depth:

The full write-up, with every command, five reference diagrams and the reload-vs-restart details:

- Qualixar blog: https://qualixar.com/research/blog/php2shell-patched-php-still-vulnerable-restart

- X Article: https://x.com/varunPbhardwaj/status/2115087831513371033

- Medium: https://medium.com/@varun.pratap.bhardwaj/php2shell-patched-php-can-still-be-vulnerable-until-you-restart-it-da83f9cbcce7

I'm Varun. On this channel I take hard technical stories apart and check every claim before it reaches you. That's AI Reliability Engineering. Subscribe if you want the next one.

Qualixar.com

Superlocalmemory.com

Agentassert.com

varunpratap.com

#PHP2Shell #CyberSecurity #PHP