PHP2Shell is a discovered family of memory-safety flaws in core PHP - tracked as CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state across requests) - with a CVSS severity of 9.2. These bugs allow unauthenticated attackers to execute arbitrary code as the PHP worker or to read sensitive process memory (passwords, tokens, keys, certificates) without prior code execution. Because the flaws live in the PHP engine itself, even minimal applications running on affected runtimes are at risk; researchers demonstrated pre-authentication remote code execution against common CMSs (WordPress, Drupal, Joomla) and application-agnostic memory disclosure. The fixes address the underlying failure patterns rather than only the specific exploit paths.
The only complete remediation is to install fixed PHP releases (first fixed: 8.2.35, 8.3.36, 8.4.27, 8.5.12) and restart Apache/PHP-FPM/long-lived workers. Interim mitigations with operational tradeoffs can reduce exposure: set memory_limit = -1 only with OS-level containment (cgroup v2), do not use RLIMIT_AS/ RLIMIT_DATA, lower post_max_size and max_input_nesting_level, disable display_errors and fatal_error_backtraces, reduce PHP-FPM worker reuse (pm.max_requests), and apply SELinux/AppArmor restrictions. These measures do not fully prevent exploitation. Indicators for investigation include malformed or large PHPSESSID cookies, odd multipart requests followed by memory errors, repeated HTTP 500s, and unexpected worker crashes; update all runtimes promptly.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.