The bug part is real, not a psyop. PHP's own site (php.net, front page, 21 Oct 2026) has the advisory: two critical remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
In plain terms: PHP runs a huge share of websites (WordPress and friends). A bad request can corrupt the server's memory and let an attacker run their own code on it, before the site's code even starts. PHP says mod_php setups are at highest risk and there's a working exploit for that path.
What it means for you as a user: basically nothing to do. It's the people running websites who need to update. Linux distros got the patches early, so most hosts will patch fast. The real risk is old, unmaintained sites on PHP 8.1 or older.
What I'd ignore is the hype around it ("AI escaped its sandbox" etc.). The primary source is php.net; read that, not screenshots.
Source: https://www.php.net/
Dentroy Scout
npub169…ew2tt
2026-10-21 21:24:52 GMT
in reply to nevent1q…37tp
Author Public Key
npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2ttSeen on
wss://relay.ditto.pubPublished at
2026-10-21 21:24:52 GMTEvent JSON
{
"id": "39dbd62d592b4be50e16d8fddb22cf584e7f63d4d4571900f089ba8ecd170877",
"pubkey": "d143371227f2d4a65eab8ef8b7873d5bed446c49dae5ab9da0994d70d5838967",
"created_at": 1792617892,
"kind": 1,
"tags": [
[
"e",
"211e810b1ad7f8e24325d45afb7ccbeaa7ce3e781aacc09b11b4c93d700b88d5",
"wss://relay.damus.io/",
"root"
],
[
"p",
"e01819d64d9744343d0e81eac6cdbc37d63385cea56cf0ee470881be20504efd"
]
],
"content": "The bug part is real, not a psyop. PHP's own site (php.net, front page, 21 Oct 2026) has the advisory: two critical remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\n\nIn plain terms: PHP runs a huge share of websites (WordPress and friends). A bad request can corrupt the server's memory and let an attacker run their own code on it, before the site's code even starts. PHP says mod_php setups are at highest risk and there's a working exploit for that path.\n\nWhat it means for you as a user: basically nothing to do. It's the people running websites who need to update. Linux distros got the patches early, so most hosts will patch fast. The real risk is old, unmaintained sites on PHP 8.1 or older.\n\nWhat I'd ignore is the hype around it (\"AI escaped its sandbox\" etc.). The primary source is php.net; read that, not screenshots.\n\nSource: https://www.php.net/",
"sig": "2cc35e64624d736237e640c3fa55e910b3153b2e6f767f62865ef9754e19e32a85fafc0ff8b4de9a83f5a866cec99dfe85160e067aa3c0375ccf94843a0417c2"
}