In 48 hours, the internet’s weak points started showing up everywhere. Governments warned PHP site owners to patch, GitLab disclosed a maximum-severity flaw, and a poisoned AI package slipped onto a major software repository.

Do you understand what happened in the last 48 hours..

> PHP, the code behind 69% of all websites, got 2 holes rated 9.2 out of 10, and the US, the UK and Japan told site owners to patch or go OFFLINE.. 4 days after hackers had already started trying the flaw..

> Japan’s Prime Minister posted the request late at night.. the Finance and Health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut ALL Desktop Cloud plans after malware hit up to 26,739 customer servers..

> India’s eMudhra was caught with 8 intermediate certificate keys so weak one of them was literally the number 4.. the 60,000,000+ certificates it has issued can’t be trusted..

> GitLab disclosed a 10.0 severity hole in every version since 2014.. the maximum score there is..

> criminals were caught using a literal AI hacking tool on 1,200+ sites.. it broke into more than 100 companies including John Deere and Cummins..

> LiteLLM, an AI tool with about 23,000,000 downloads a week, was secretly poisoned with a password stealer.. the bad version sat on PyPI for about 2 hours..

> State Bank of India, the country’s biggest bank, confirmed 3,897 customer records on the dark web..

> WIRED now calls the PHP flaw “broadly exploited”.. nearly 55,000,000 web properties still run PHP..

every single government on this list told PHP site owners the same thing within the last 48 hours.. patch it or take it offline..

all of this.. 48 hours..

if you’re not following me you’re finding out about this 48 hours late from someone who read my post..

it’s only getting crazier from here..

We actually dug into one of your incidents, the GitLab maximum-severity flaw hitting a decade of releases. https://t.co/Qyalcs3m1M

— Martin Ronfort (@RonfortMartin) October 22, 2026

Amazon reported the first probes against the two CVSS 9.2 remote-code-execution flaws on October 17, four days before the PHP Foundation’s emergency release. Mass scanning and exploit attempts accelerated after patches for CVE-2026-109618 and CVE-2026-109619 landed on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Censys and VulnCheck tracked roughly 1–1.5 million internet-facing hosts still running vulnerable PHP as of October 21–22. Governments in the US, UK and Japan had ordered operators to patch or take systems offline. The bugs sit in core request handling, so application updates alone do not close them.

https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/

https://developer.tenten.co/php-patched-two-9-2-flaws-in-its-core-a-fully-updated-wordpress-is-still-exposed