PU 59: PHP2Shell

AI has found a very serious vulnerability in 70% of websites. Are we lucky here? Or will the world end because of it? In fact, AI has almost nothing to do with this story. Humans do, however.Punching Upwards, Episode 59 for 25 October 2026Topics: Infosec / Artificial Intelligence🦉 No AI Content 📢 Podcast RSS FeedCreditsThanks to Michael Mullan-Jensen, Evgeny Kuznetsov, Vlad A Gouf, Fadi Mansour, Bennet Piater, Eric and Sir Galteran for supporting this podcast financially and therefore making it possible for me to produce it!Sources* A tale of two PHP remote vulnerabilities, Ryan Austin, Calif, 21 October 2026* PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, Sagi Tzadik et al., Wiz, 21 October 2026* Today’s PHP Security Release, and How We’re Strengthening PHP Security, The PHP Foundation, 21 October 2026* Finding and Exploiting a 21-Year-Old Vulnerability in PHP, Ryan Austin, Calif, 1 May 2026* PHP Audit Complete!, OSTIF, 10 April 2025* PHP memory_limit remote vulnerability, Stefan Esser, Bugtraq, 13 July 2004* Exploiting the php , Bas Alberts, 18 August 2004 (archived copy)* Sicherheitsspezialist verlässt resigniert PHP-Security-Team, Daniel Bachfeld, heise online, 13 December 2006* PHP Security Specialist (Stefan Esser) Resigns, Darknet, 18 January 2007* Long variables in multipart/form-data cause OOM and temp files are not cleaned, jr@coredu.mp, PHP Bug Tracker, 28 November 2019* AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack, Emily Forlini, Fortune, 21 October 2026* AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk, Robert McMillan, The Wall Street Journal, 21 October 2026* A.I. Discovered a Critical Security Flaw Underpinning Websites, Dustin Volz, The New York Times, 21 October 2026* Government websites go dark after AI-discovered flaw sparks security scramble, Raphael Satter et al., Reuters, 21 October 2026* Wichtige PHP-Updates am 21. Oktober beheben Codeeinschleusung-Schwachstellen, Dr. Christopher Kunz, heise online, 21 October 2026* php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP, Dr. Christopher Kunz, heise online, 21 October 2026* <a target="_blank" href="https://www.cve.org/CV