The critical PHP security flaw that broke the internet

GitHub traces the disclosure and emergency response, focusing on the gap between leaked exploit details and deployment of an official patch.

From unconfirmed bugs to remote code execution

AI-assisted security researchers demonstrated that two previously unconfirmed PHP bugs could lead to arbitrary remote code execution. The FBI issued an urgent advisory warning organizations to patch affected systems or take affected servers offline.

Emergency response across the open-source ecosystem

Exploit details leaked before an official patch was deployed, creating a race to protect millions of servers. Maintainers opened an emergency pull request for the official PHP Docker image as part of the response.

The pull request became a focal point for people following the incident, drawing more than 500 comments in what GitHub describes as a live watch party. The account highlights both the urgency of addressing a remotely exploitable vulnerability and the public coordination involved in responding through open-source infrastructure.