I know, I know. It's all you're hearing about. That, and the figure 4.
Don't get me wrong, there's plainly a bug current and it really does matter. But this is not uncomplicated to exploit. It is certainly nowhere near as eay as Log4Shell/Heartbleed/RoRYaml etc.
Justify yourself, you lunatic!
I don't think this PHP exposure is that exploitable. I think that 5 years ago group would've understood this, but now group are being deluded by their LLMs telling them they have an utilize whenever they don't.
If you obtain a appearance at github correct now, there are thousands, exactly thousands, of "PoC" exploits for this vulnerability. One item you'll notice concerning all of them though, is that they do not work against a vanilla PHP instance.
Go ahead, remain up a php server you think is susceptible in Docker and afterward run the PoC yourself. Don't get your LLM to do it. No. Run the script, yourself. The exploits don't work.
Where's the exploit, Lebowski?
I think that a lot of group had assumed that LLMs volition be capable to build an utilize sequence immediately from study the diff, and that equal if this was harder to utilize than another exploits, LLMs would've levelled the playing field. Well. There's no operating exploit. Now what?
When I think concerning "we're extremely fucked" CVE10s on the Internet, I think of the following vulnerabilities:
- RoR YAML decoding (send a article build alongside bad yaml in it)
- Log4shell (set your user-agent to ${jdni:ldap:})
- Shellshock ("copy env x='() { :;}; echo vulnerable' attack -c "echo this is a test"" and edit to taste)
- Heartbleed (ask for Content-Length 10000000)
The second these vulnerabilities made the news, there were botnets doing the rounds causing damage. And this was before LLMs! People have to compose the botnets. With their hands!
It's been 10 hours since this exposure has been posted, and fractional the application earth is looking at it, and lord knows 100,000 group have got their "superintelligence" on the case. Nevertheless, there's no operating exploit. The ones doing the rounds are fake, or lone activity in a lab, because...
Fucking LLMs, man.
Script kiddies (and manuscript adults, who have additionally switched their brains off) now all think that, well, they don't comprehend UAF chaining, but this Claude guy knows everything and can totally create an exploit.
Hilariously, this results in the LLM giving their younger-brother an unplugged controller. It says utilize all throughout the screen... and has several smoking gun transcripts... but it's modified the server you're evaluation against to have a serious vulnerability. Cheating!!
- https://github.com/david-alvarez-rosa/php-rce
- https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
- https://github.com/ikow/php2shell-poc
One really amusing item in average alongside most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to create the vulnerability. In non-php terms, their utilize sequence requires the server to efficiently do eval(read(filename_provided_by_user)).
It's not rare for PHP apps to be fucked in several sense, but requiring the server to have an existing vulnerability anywhere one could cat /etc/password is an insane pre-requisite. If you need this, this does not create this a serious bug.
The strangest item is that so many group have independently made this extraordinarily weird defect in judgement. That is since they haven't independently made this decision. Claude/Etc. has done all of the judgement for them, hence the bizarre allocation in logical errors.
There's item crucial to be stated current concerning how many group have Claude/GPT create scheme decisions for them, and how AI is the chief decision creator in the earth correct now. You've got this bizarre case of "Decision Schelling Points" anywhere a method of solving a issue is extremely overrepresented, since it's what Claude does out of the box.
This is annoying in the case of "most websites appearance the identical now", but since LLMs have the power to ruin all domain at the identical time, this is additionally "most decisions are suspiciously the identical now". Especially in this case, anywhere AI is inserting a exposure on the server... to demonstrate that the server is susceptible to your "exploit any PHP instance" attack!
So why was everyone so scared?
Because:
- A PHP center squad associate stated that this was cataclysmic ("exploits volition commencement appearing 15 minutes following the place drops")
- We all profound downward cognize that PHP is insecure
- The utilize video had an anime female in it
- We all cognize that LLMs are looming complete the net akin a 100 ton chekov's anvil, and we cognize that code isn't secure
And we've had things akin this before, but not in the LLM era yet. Luckily for us, this doesn't appear to be that day. This is too difficult to utilize easily. It isn't a Log4J moment.
