PHP Just Had Its Worst Day Ever (PHP2Shell)

PHP2Shell is two critical bugs in PHP itself, rated 9.2, that can let attackers run code on PHP servers, and PHP runs roughly 70% of websites. We cover how the disclosure leaked a day early, why the NSA, CISA, the FBI and the UK’s NCSC told organisations to take unpatched sites offline, and how 4chan, Wikimedia, DigiD and even BreachForums went dark. Then there’s the fight over who found it between OpenAI, Wiz and Calif, plus the same-day Node.js, GitLab and Railway security news.