# PHP emergency RCE patches AI & tech · Heat 5.4 / 10 · 8 shows · 1h 30m airtime The PHP development team announced on October 20 that emergency updates for two remote code execution flaws, each initially rated 9.2, would ship October 21 at 1400 UTC, after the secret patch leaked on Hacker News two days early. The second flaw is now rated 10 out of 10, with fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence saw exploitation attempts against its honeypots as early as October 17, and Palo Alto Networks found 22 million places where the vulnerability persists. The patches cover only PHP 8.2 and newer, and downstream projects could not build new releases before the accelerated date, so some sites shut down instead of patching. Page: https://boilpoints.com/point/php_emergency_rce_patches_3273303853 ## Segments - [Tech Brew Ride Home](https://boilpoints.com/u/techbrewridehome), 2026-10-21, 1:24 to 5:35: **Retells the PHP advisory and embargo leak**. Walks through the PHP team's advisory and the BleepingComputer reporting: two 9.2-rated RCE flaws, Watchtower's confirmation and reproduction of one CVE, the leaked embargo, and Cloudflare's stopgap WAF rules. A straight retelling of the disclosure, with no independent reporting. New angle: Two PHP RCE flaws rated 9.2 are set for emergency patches on October 21 at 1400 UTC after an embargo leak. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-21, 3:11 to 7:10: **Walks through the PHP 2 Shell timeline**. Walks through the PHP 2 Shell flaws: the GPT-5.6 Sol discovery in August, the 200-file patch, the Thursday October 22 plan and the Tuesday leak that pulled the release forward. Adds the second flaw's 10-out-of-10 rating and the specific patched versions. New angle: The second PHP flaw is rated 10 out of 10; patches ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-21, 7:10 to 10:59: **Explains why the flaw went unfixed so long**. Explains why a decades-old flaw went unfixed and why the patch shipped early: word leaked on Hacker News, forcing a scramble, and a patch that size carries regression risk. Stays inside the leak and patch timeline already on the record. - [TBPN](https://boilpoints.com/u/tbpn), 2026-10-21, 3:08 to 13:00: **Adds the NSA notice and Japan's warning**. Walks through the php2shell saga from the August discovery to the rushed patch, then adds what earlier coverage did not have: the NSA notice, Greg Brockman's call for government scanning of the internet, and Japan's prime minister urging sites to patch or go offline. New angle: The NSA issued a notice on the PHP flaws, and Japan's prime minister urged sites to patch or suspend. - [TBPN](https://boilpoints.com/u/tbpn), 2026-10-21, 35:26 to 57:33: **Adds the CEO's count of exposed PHP installs**. Palo Alto Networks' CEO joins for the bulk of the episode on the PHP flaws. He puts a number on the exposure - 22 million places the vulnerability persists, maybe 9 or 10 million after trimming - and says his firm is pushing a virtual patch to firewall customers so they can skip the manual fix. New angle: Palo Alto Networks' scan found 22 million places where the PHP vulnerability persists, and it is pushing a virtual patch to firewall customers. - [TBPN](https://boilpoints.com/u/tbpn), 2026-10-21, 2:29 to 10:59: **Adds the European outages over the flaw**. Walks through the PHP2Shell saga from discovery to disclosure, then adds a detail not yet on the record: Finland, the Netherlands and France temporarily took some internet services offline over the flaw. The rest is retelling - the August discovery, the 200-file patch, the Hacker News leak, Brockman's post and Japan's prime minister. New angle: Finland, the Netherlands and France temporarily took some internet services offline over the PHP flaw. - [Morning Wire](https://boilpoints.com/u/morningwire), 2026-10-22, 8:31 to 13:14: **Reports the NSA alert on the PHP flaws**. Reports the NSA emergency alert on two critical PHP flaws found by AI agents, the European government sites pulled down, and the leaked unofficial fix that preceded the official patch. Frames AI vulnerability hunting as the new normal. New angle: NSA AI agents found two critical PHP flaws in code that sat for over a decade. - [Start Here](https://boilpoints.com/u/starthere), 2026-10-22, 18:20 to 23:47: **Explains the PHP flaw and the patch**. Explains the PHP flaw with a restaurant analogy and reports that OpenAI's Patch the Planet program confirmed the exploit path and helped build the patch, while Finland pulls public sites offline. New angle: OpenAI's Patch the Planet program confirmed the PHP exploit path and supplied the basis for the patch. - [Morning Brew Daily](https://boilpoints.com/u/morningbrewdaily), 2026-10-22, 2:56 to 7:36: **Walks through the leaked PHP patch timeline**. Walks through the PHP to Shell disclosure: the AI-assisted discovery, the leaked patch timeline, and the global scramble as governments told agencies to update or go offline. Frames it around OpenAI's shrinking defender's window. New angle: The secret patch leaked on Hacker News Tuesday night, two days before its planned Thursday release. - [Tech Brew Ride Home](https://boilpoints.com/u/techbrewridehome), 2026-10-22, 1:19 to 4:07: **Reports patches stopping at PHP 8.2**. Walks through the patch fallout: the PHP Foundation's fixes stop at PHP 8.2, so legacy deployments are left to third-party vendors, and the current release is 8.5.12. Also credits the AI discovery chain (GPT-5.6 Sol, Wiz's Atlas agent) and repeats the NSA's pull-it-offline guidance. New angle: The PHP Foundation's patches cover only PHP 8.2 and newer, leaving legacy deployments to third-party vendors. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-22, 3:26 to 10:19: **Reports honeypot hits before the PHP patch**. Reports Amazon Threat Intelligence's finding that PHP2Shell exploitation attempts hit its honeypot network as early as Saturday, October 17, before the leak or the patch. Walks the embargo timeline and Chain Guard's early release, and notes none of the early attempts succeeded. New angle: Amazon Threat Intelligence saw PHP2Shell exploitation attempts against its honeypots as early as Saturday, October 17. - [The AI Daily Brief](https://boilpoints.com/u/theaidailybrief), 2026-10-22, 19:22 to 21:23: **Collects reactions to the PHP patch rollout**. Collects reactions to the PHP disclosure: a big-tech friend planning to patch in a few days, Mollick on companies struggling with the rate of patches, and critics asking why the rollout was so poor. Explains that the patch itself reveals the exploit, which is why the NSA warned sites to go down. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-23, 13:18 to 14:44: **Polls the angles the show already covered**. Poses the week's Big Tech Question as a multiple-choice poll on the PHP2Shell story, listing the angles the show covered: AI discovery, the early leak, pre-disclosure exploitation, the limited outage and the separate TLS certificate flaw. A recap that points listeners back to earlier episodes. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-23, 14:44 to 16:40: **Credits CDNs and admins for holding up**. Robb Dunewood's round-the-horn answer: the surprise is that the internet held up. Credits Cloudflare, Akamai and Google Cloud CDN for mitigating before the patch and admins for patching within 20 to 30 minutes. Reaction, not new reporting. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-23, 16:40 to 17:54: **Reacts to the outrage over the broken embargo**. Sarah Lane's reaction segment: she was unsurprised by the leak and early exploitation, and was instead struck by colleagues' outrage at whoever broke the coordinated 11 a.m. Eastern Thursday embargo. Reaction and framing, no new development. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-23, 18:24 to 20:00: **Praises broadcasters' plain-language PHP explainers**. Pauses on the PHP story to praise how mainstream broadcasters explained it, with analogies rather than jargon. Notes it was the number two story on BBC World Service the morning it broke. Reaction and media criticism, no new development in the flaw itself. - [Daily Tech News Show](https://boilpoints.com/u/dailytechnewsshow), 2026-10-23, 20:00 to 21:47: **Reacts to the leak hitting manga sites**. Reaction segment on the PHP2Shell saga: Dao is surprised the internet held up, the leak happened, and manga sites she subscribes to were hit, with non-technical users trading notes in their forums. No new development, just personal reaction inside the existing coverage. - [Equity](https://boilpoints.com/u/equity), 2026-10-28, 2:47 to 4:52: **Explains why sites went dark instead of patching**. Tomer Schwartz walks through the disclosure scramble: the leak forced an accelerated release date, and downstream projects that could not rebuild in time are why so many sites went dark rather than patch. New angle: Downstream projects could not build new releases before the accelerated date, so sites shut down instead of patching. - [Equity](https://boilpoints.com/u/equity), 2026-10-28, 4:52 to 6:01: **Recounts the parallel discovery and shared Slack channel**. Wiz's CTO walks through the parallel discovery: Calif found the first CVE and reported it to OpenAI and PHP, Wiz found both independently, and the PHP team pulled everyone into one Slack channel to build the patch together. New angle: The PHP team convened Calif, OpenAI and Wiz in a shared Slack channel to work the patch together.