Hacker News

>OpenAI and these security companies sat on this for 2 months

these security companies reported it 2 months ago. it took a month for the php security team to acknowledge it and another month for the php team to develop & release the patch.

if you're going to be upset at anyone it should not be the reporters.

>The official interim fix for php8.5 [1] could have been published 24h ago, or even 2 weeks ago, without revealing any security details.

publishing the fix = publishing the security details.

One concern with the current environment is that as soon as a release comes out for such an important open source project, people will immediately point bots at the release to look for changes that might be related to existing security issues. This means that putting out a quick out-of-band release is guaranteed to result in people racing to exploit the problem before many even know there is an update out.

Whether keeping the update quiet and including it in the next normal release, where there are more trees obscuring the wood that is the security concern, and announcing the bug a short time later once anyone using distro updates or otherwise keeping on top of things have updated, would be safer overall than what has happened today is up for debate. I can think of arguments in both directions.

--------

[1] which does have a slight whiff of AI marketing about it - would a human-found issue, without the option of a big AI company to claim some credit, have been handled differently?

It's not possible to publish a security patch for an open source software report without revealing security details anymore (and as of the past couple weeks I would not count on being able to do that for closed source binaries either). The moment you push publish everyone knows previous versions are compromised

“OpenAI and these security companies sat on this for 2 months”

I don’t think this what happened at all, and even less so to specifically call out OpenAI.

The issue was discovered using their model, it was disclosed, and the PHP team took months to address it. Eventually it leaked.

This is a process / people failure that does not involve the people responsible for discovering it.

You can't do secret releases, people will figure out what you added or changed.

But they could have accelerated the patch release once the embargo was broken and rumors of a PoC started going around. There was no need to wait 12+h today until the release.

Maybe the NSA ‘requested’ some time to use the exploit on some high value targets.

Sure, it’s PHP, but plenty of companies or organisations might have some PHP running somewhere; and once you’re in, lateral movement becomes a lot easier.

Php core security team decided who gets to know. The patch was huge it took that long.

See PHP foundation blog post on their timeline

> OpenAI and these security companies sat on this for 2 months

The PHP team knew about it since September 21st.

Maximizing the PR value...

And then they proceeded to cripple any of my agents working on this.

> OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix

Amazingly, AWS Linux has not been patched yet.

Of course it was OAI that decided those things, not the U.S. Government

If I understood the timeline correctly, there was an announcement made somewhere that an RCE would be announce w/ a patch, and the internet just scanned the entire codebase, they really fumbled this for the sake of having a PR post for OpenAI.

On the other hand, I don't mind AI companies doing this sort of thing, I'm sure a lot of our internet infrastructure could benefit from these sorts of fixes and changes.

> And they botched this as someone talked. To me this looks like they used this for a PR stunt and aimed for an RCE.

This is a pretty constant theme in the infosec industry. The idea is that you want to do the "responsible" thing and let all the major, multi-billion-dollar companies patch first, so you form a secret club. But then, you share a very juicy, gossip-worthy thing with hundreds of people and ask them to sit on it for weeks. And guess what happens: they don't. Having worked for a big tech company, I've been involved on a couple of processes of this sort, and they all suffered leaks.

And rest assured, we'll learn nothing and try the same thing again next month or next year. Because what's the alternative? If you 0-day everyone, you get more hate mail, not less. It's all of sudden about you, not the vulnerable code. Microsoft or Cloudflare calls you irresponsible when asked for a PR statement, industry bloggers bully you, etc.

They haven't even been able to release the patch on time. Ubuntu still hasn't it

Wiz is owned by Google and Argon gets the main credits. So difficult to tell these days. But AI is obviously useful here.

Edit: was looking Wiz post when citation was from OpenAI

I heard this was leaked several days early and that’s why folks seem to be on the back foot.

I’d press go too - if something this big was known to some but not all…

We’ll all get through together

Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).

I am curious about that, too

Here was a PoC: https://jackalsyn.com/posts/php-up-2026.html

But it was withdrawn; now it says that it (CVE-2026-109618) is not an RCE and not even a CVE, apparently an addref call prevents the use-after-free. CVE-2026-109619 is still a memory safe bug, but they have no RCE for that one

Well, WP is just a program written in PHP.

Because the CEO of Wordpress has gone insane, basically.

WordPress is down right now. A bit late for patching though ...

I agree, WordPress should be like the first thing they point out. I'd imagine most WordPress users don't even know it runs on PHP

I wonder how early the domain was registered and when the first certificate was issued for it, whether you could’ve had advanced notice of this by watching the DNS records

It’s in-line with the rest of the pho eco system.

"The entire world should use 2x more compute" is not a real answer. You can do that on your own personal computer which has compute to spare. For servers, you're already paying for the relevant amount of compute to serve your thousands or millions of users, and every % of overhead matters at that scale. You are suggesting everyone allocates a 2x budget for server-compute, or I suppose you're only talking about hobby servers where people are running tiny workloads and had so little traffic it doesn't matter?

People keep defending PHP (as they have been for ages) saying things like "oh, it could happen to any platform, this one's just so popular so the odds are higher" but then you take a peek at the diff for this fix and realize that nothing has changed since Fractal of Bad Design was published a decade ago. PHP is a scourge and unfortunately a still too popular one. The best time to realize the only safe option is to stop using it was in 2010, the 2nd best time is now ..

For now this is just one person posting about it. Can be real, can be a mistake, can be a hoax. But if it's real, then OpenAI once again fudged up really bad.

"skill check"

*rolls 3"

"Your IPO gets delayed another month"

Ugh these comments on GitHub. Don't people know when it's best to just post nothing? "516 hidden items"

It went a few seconds ago. I was also surprised they didn't have advance access but thinking about it, with the whole thing being a public Github pipeline, it's unclear how they could have achieved it whilst simultaneously keeping the patch private. Is there precedent?

Yepp, we're seeing the Debian images now for 8.4.27

That's placeholders for images, you can't actually pull them yet.

https://hub.docker.com/layers/library/php/8.5.12-fpm/images/...

I'm legitimately surprised half the hostnames on the internet isn't serving ClickFix or whatnot payloads already.

The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.

Giving me log4j vibes.

I think some of the issues could have been avoided here, if they would not chase the PR and blog posts.

... a second feline has hit the stack.

Someone tell Ondřej to sell some self-published "guide to PHP" for $200 and we can easily expense that.

Open source projects are severely undervalued.

While we're at it, please hassle employers to donate to OpenBSD so we don't get another heartbleed

It's not exactly uncommon, it's basically C's equivalent to exceptions. It lets you avoid having to do an extra error checking branch after every fallible operation and can quite significantly speed up the happy path of a language VM.

Not that uncommon for a language interpreter? Pretty sure MicroPython does some setjmp/longjmp for non-local returns.

Never use Ruby then.

No, every platform affected.

> Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

https://www.php.net/archive/2026.php#2026-10-21-5

Git doesn't have a concept of "fork".

GitHub uses this metaphor, and, as another commenter already aptly described, it could be nothing more than a fancy name for namespaced branches, on the server side.

On the client side, "forks" are usually different repository clones with different remotes and a "coincidentally" shared history.

But you can also map forked repos to multiple remotes of the same repository for example, instead of folders.

Assuming that forks would live in separate clones/blobs on the server is not really based on anything, so I think the warning is a good middle ground between explaining what forks are and how they handle them, and giving actionable advice.

It's also better suited for PR:

"Fork me on GitHub"

vs

"Branch and push your own clone on GitHub, using our shared blob optimizations".

I think the warning is clear and there's nothing misleading about it, but others have already pointed this out and git can be tricky.

It's so good at providing the right level of abstraction to everyone though, it seems!

Similarly, GitHub invented the term "Pull Request" (aka PR, lol).

Not a git-owned term.

But "merge request" isn't a Git primitive either!

And, with Forks and Pull Requesrs, GitHub made a particular workflow in Git approachable to anyone!

I love GitLab, but people get confused by Merges, myself included, so the GH-enabled workflow of favoring ff-only merges, without merge commits, with quadi-linear history, became the norm and helped Git succceed!

But I also appreciate being able to do all kinds of different workflows.

So PRs were positive-sum PR at the time, I'd say. When they became popular, I was still taught Subversion and CVS at uni, alongside Git as "the new thing". Ar that time, many people considered the older systems simpler, and pondered SVN as the most reasonable middle ground between CVS and the decentralized concept of Git!

There is little difference between a tag and a branch in git. There is just the convention that tags reference the same commit forever, while branches move.

On github forks are part of the same physical repository. You could imagine that each logical repository is just a namespace for branches and tags, backed by the same physical repository.

I do consider the warning a bug if github, it should check both tags and branches for commits which are to be considered part of a logical repository.

It can mean either, it's a consequence of how github optimized their backend storage so a 100 forks of a repo initially take up the same space as 0 forks

main (or master) is just another branch to git.

Definitely not available yet, launchpad says last builds are from 2026-10-12

You can see them building here, it looks like most should be ready within the next few minutes:

https://launchpad.net/~ondrej/+archive/ubuntu/php/+builds?bu...

Yeah, Linode still hasn't updated their mirror. Vultr has though.

Edit: Linode just updated its mirror.

Patches have now landed for 20.04 and other earlier Ubuntu versions.

Yeah I got repeated error for igbinary (and then find out I didn't use redis in this project and could remove it).

Is Pie (which I learned about it today) a painless migration from PECL?

I once wrote a PoC for reading data off of a dead Open Compute Grand Canyon server that wouldn't boot by sneaking it off of the HDDs through a sideband through the BMC. Never say never.

Well they did specify "successfully." EITW is a pretty broad tag, just means attacker are probing servers. I'm not saying it's good but there are usually some pretty big caveats with remote-remote memory corruption, don't know if all the people dooming are aware of that

> Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout.

I really like the idea of sharing details prompts/specs.

It feels like many times PRs could just be that.

makes sense, will release the docs. thanks!

Is there some reason the biggest company on earth who likely had advanced notice of this cannot put out a patch?

Check the tags:

https://github.com/php/php-src/tags

Usually by extracting the layers and looking through them. There's dive (https://github.com/wagoodman/dive) for making that easier.

packages are building:

https://buildd.debian.org/status/package.php?p=php8.2&suite=...

Already, including backports to 7 and 5.

Yeah… it was patched in the source 3 days ago. Check the linked GHSA.

Just a note to say thank you to all of the above commenters, appreciated

exactly why I asked, because those builds for 8.5.12 are not available yet

If true then classic CGI mode should not be vulnerable, but apparently it is.

That's why I mentioned vendors. They patch it before announcements.

Also, sandboxing makes automatic exploitation harder. There is no FS persistence, so some checks simply do not pass.

It's great they are doing mitigations, but they admit themselves, in fine print, that this will not protect you from the vulnerability

Why is word circulating that you can just sign up for Cloudflare and be 100% protected from this? They are burying the leed and trying to get new customers, and it's working.

HN should ban comments that are just Claude output

It's just Claude output of what I've done; the other URL has the basics.

Why don't you do something useful and rewrite it so it's not claude output any more, but says the same thing in a way that you're satisfied with?

Then your own comment would not be such low effort and useless human slop.

Do you agree or disagree with the comment's claims? Did YOU verify anything? Let's all hear you fact check and proofread and reword what it said so it matches your standards, instead of just listening to you bitch and complain without offering any useful information.

Or do you not actually know anything about PHP administration, programming, and security, so you're only capable of information-free drive-by anti-ai posts, without any other useful content or corrections?

Ball's in your court.

yup

People shouldn't be using PHP. I was shocked some security focused websites are even using it. I just hope there's nothing of value on their servers and that it's not connected to their internal network in any way. In my experience this is almost always the case because it makes maintenance and development easier but effectively exposes your entire organization to the internet.

That 70% of the internet still uses it is shocking to me. These organizations deserve to get burned badly. Let this incident be a warning to all of them!

And how Crowdstrike was done after their fiasco 2 years ago...

always will be

You can only do that if you have access to the binary. Which, in a web service, you shouldn't be able to access!

> Know how recompilers are porting video games from one platform to another these days?

They actually aren't. Most of the claimed cases of "recompilation" are just an emulator packaged into the same binary as the game so you can't tell it's an emulator, or are for projects that already had their source code available (in which case "porting" to WASM is trivial because all of the hard work is done by the people who write your-language-to-WASM compilers, and you just need to do a little bit of work to adjust your toolchain to use it). Everyone just takes slopshit at face value and shares clickbait without actually checking any of the work done. It's infuriating how empowering this software is for liars, honestly.