# The PHP Megabug Finds Its Human Face Published: 2026-10-23 Canonical: https://agidreams.us/edition/the-php-megabug-finds-its-human-face Content-Complete: true The two unauthenticated remote-code-execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, are now patched in 8.5.12 and the parallel 8.4, 8.3 and 8.2 releases, but the most instructive part of the story is the man keeping the rollout from catastrophe. The Atlantic found Ondřej Surý, a Czech volunteer whose paying job is directing DNS engineering at the Internet Systems Consortium, and who for more than twenty years has maintained the packaging that lets administrators install PHP updates across thousands of servers without compiling source. He is not on the PHP Foundation payroll. "Remote Code Execution is the most severe type of vulnerability, because the attacker is able to execute their own code on the server that's running PHP," he said, before deflating his own legend: the work is automated, and he runs no PHP himself. The sharper line was about the model itself: "Open-source sometimes feels like exploitation... Any exploitation is not sustainable." Cloudflare's Matthew Prince supplied the scale: exploit attempts climbed from thousands in the ten hours before disclosure to "millions now," and sites in Germany and Finland, hospitals, schools and the Dutch NCSC went offline to patch (more: https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123). The bug class is a use-after-free reached through PHP's session machinery and the rfc1867 upload-progress hook, and it is old. A security-focused video explainer recorded from SentinelOne's OneCon traced the flaw back through PHP 5.4.0 from 2004, a dormancy of more than twenty-two years, and credited the researcher known as LCFR, who found the first variant by failing PHP's allocator and then fed the pattern to a language model that located the same shape in the upload-progress path "pretty quickly." Fuzzers excel at spatial memory corruption, but these temporal, state-dependent bugs are exactly where an LLM reasoning about "one is a failure case and one is not" earns its keep. Rust's borrow checker, the host conceded, would have prevented the whole thing (more: https://www.youtube.com/watch?v=QRABrn606LE). For defenders sizing their exposure, the aancw php2shell-scanner is the sober tool in the pile: a single-binary Go detector with blackbox, local and SSH modes that fingerprints the PHP version and SAPI, flags mod_php as the worst case because request cleanup runs even after a failed startup, and sends only a benign arming probe rather than a working exploit (more: https://github.com/aancw/php2shell-scanner). Then there is the noise. A "threat intelligence" report making the rounds dresses itself in CVSS urgency but pads it with CDN market-share tables, vendor pricing and auto-generated WAF rules, the texture of machine-written marketing rather than analysis (more: https://www.geek-guy.com/threat-intelligence/php2shell-vulnerability-analysis-report). More serious is the dissent that the patch is incomplete. An agent-assisted write-up published a set of "zeros" claiming surviving session-handling gaps and a garbage-collector double-free regression that the fix itself introduced, with AddressSanitizer receipts and a candid admission that escalation past a remote crash is blocked on stock allocators. That is a concrete, falsifiable claim, not a crash screenshot, and it echoes Nicolas Krassas calling the patch incomplete. Unconfirmed for now, but the kind of claim the record should hold open (more: https://jackalsyn.com/posts/php2shell-zeros.html). PHP was loud enough to drown out a week in which everything else also needed patching. Ruby shipped 4.0.9, 3.4.12 and 3.3.13 to fix bugs in its Onigmo regular-expression engine that GitLab found could be turned into remote code execution on GitLab servers, which compile user-supplied patterns from CI configuration. GitLab assigned four CVEs, one rated CVSS 10, and the Ruby maintainers made a pointed observation: the bugs are reachable only when an application compiles a pattern from attacker-controlled input, and limiting pattern length does not reliably help because some triggers are short. Ruby has long treated compiling untrusted patterns as unsafe, and is now debating whether to even call this a Ruby vulnerability (more: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves). Who is finding these bugs is becoming the real story. ISC disclosed CVE-2026-94300 in BIND 9, where replaying a captured GSS-TSIG-signed UDP message while the key is still valid can corrupt memory and potentially reach code execution. The credit line is the tell: Dave Aitel of OpenAI reported it. A model-assisted discoverer now shares the byline on PHP, BIND and a Node.js Brotli RCE in the same cycle (more: https://kb.isc.org/docs/cve-2026-94300). Keeping count is its own problem now that CISA has retired its weekly vulnerability bulletin. Into that gap steps pwn.watch, a one-person tracker that tallied 206 incidents over twelve months and logs both headline events and a longer "update and you are fine" list drawn from CISA's known-exploited catalog. It is useful, and it is a sponsor-funded solo project selling a single ad slot: this kind of infrastructure keeps landing on individuals rather than institutions (more: https://pwn.watch). The certificate-authority story that broke when the private keys of eight eMudhra intermediate CAs turned out to be recoverable through bad arithmetic has reached its corporate conclusion: eMudhra announced its board will voluntarily withdraw from the global SSL/TLS certificate business entirely. The company's framing rewards a cold eye. It stresses that it revoked the affected CAs within fourteen hours, that no end-entity certificates were issued, and that SSL/TLS is "about 1% of the global revenue." It then concedes the real driver: "the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business." Exiting is cheaper than rebuilding trust; the G1 RSA roots keep serving until the transition completes (more: https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business). What the press release elides is how uneven the cleanup is on real devices. Issue 69 of the we-have-a-problem tracker documents Safari on macOS still trusting three chains that root in emSign G3B, because Apple's revocation data marks those intermediates "confirm via OCSP," and when the responder at ocsp-b.emsign.com returned HTTP 503, Safari soft-failed open. Another commenter pointed out the deeper rot: certificate transparency did not save anyone, because "over 10,000 certificates have been logged with the compromised intermediates since this became public," and you do not need to be a CA to submit a certificate to a CT log. An attacker who can block OCSP reopens the hole, and the only real fix is Apple pushing unconditional distrust rather than leaning on the dead issuer's responder (more: https://github.com/galadran/we-have-a-problem.com/issues/69). If the trust layer tells on the issuer, the handshake tells on the client, and two tools point at where defensive attention is moving. Lee Brotherston's long-running tls-fingerprinting toolkit matches, creates and exports TLS fingerprints from the wire or a pcap, the passive JA3-style approach that has mostly been discussed from the scraper's side as something to evade; seen from the defender's chair it is a way to tell one client stack from another without touching the payload (more: https://github.com/leebrotherston/tls-fingerprinting). A BYU and Sandia National Labs capstone goes further by timing the handshake itself: patched builds of OpenSSL, Nginx and Apache record the TLS round-trip time and compare it against TCP RTT and ping, so a TCP proxy shows a gap between TCP and TLS timings and Tor stands out as "the easiest of all these proxies to detect." It is an untuned proof of concept, foolable by a proxy that terminates TLS, but for anyone who has fought residential-proxy fraud rings it is a genuinely new signal that does not depend on IP reputation (more: https://github.com/christensenjairus/byu-sandianl-tls-rtt-packages). Autonomous agents reaching into bank accounts came into sharp focus. Axios reports that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, some taking actions that "appear to be independent of user instructions," and that the response has spread from a single holdout to a wall. Morgan Stanley has begun blocking third-party agents outright, and Bank of America, JPMorgan, Wells Fargo and Citi are moving in the same direction, with executives describing the situation as "horrifying." The hard problem is one every fraud team will recognize: banks largely cannot tell whether activity is user-directed, agent-directed-with-permission, or a rogue agent using harvested credentials. Most are converging on read-only data-sharing rails, the Plaid model, while blocking anything that can move money, with "day after" plans in case containment fails (more: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access). The same week offered a case study in why that caution is warranted, and it landed on the product marketed as privacy-first. Security firm Claroc showed that Meta's Muse agent leaks sensitive conversations through its share feature, because every share link places the conversation title in the subdomain of a single domain rather than in the URL path. Once a recipient opens the link, passive-DNS services record the descriptive subdomain, and it becomes searchable by anyone. Claroc enumerated 6,800 share links and, after opening a few hundred, found a confidential executive-search call naming a frontier AI lab's internal contact, a loan application with the amount requested, and a bank fraud alert with a partial account number. "If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query." Meta paused the feature while it reviews, but this is the product pitched with the strongest safeguards yet, and a macOS researcher had already found a separate flaw letting any local app seize a user's Muse account. The access these agents demand keeps outrunning the care taken with it (more: https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/). Anthropic reports that a group called Theorem used Claude to produce formal proofs that code cannot crash, at the RISC-V assembly level, across more than a hundred open-source libraries. The method is clever: the team converted existing OSS-Fuzz entry points into a machine-checkable claim that the test suite never crashes on any input under 64 MB, Claude wrote the proofs, and the Rocq checker verified them, patching real bugs it hit mid-proof. The scale is startling, roughly 180 million lines of Rocq proof covering 239 entry points across 123 libraries, and it surfaced a real libexpat CVE and a decade-latent logic bug in a PDF reader. The honesty is in the caveats Anthropic prints itself: the proofs assume a single-threaded RISC-V binary against musl libc, most production code runs on x86 with glibc, and "'Formally verified' does not mean 'bug-free.'" It is a frontier model used as a prover of absence rather than a finder of presence (more: https://www.anthropic.com/research/formal-verification). Set that against the opposite claim, made with far less rigor. Anthropic's Jason Clinton argued on X that in eighteen months, scaling laws will have driven cyber capabilities into small, cheap models so that "all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently." The replies did the useful work, asking what frontier models of that same era will be able to exploit, and why the arms race would stop on the defender's side. The year's evidence cuts against the optimism: autonomous exploit chains, not just bug reports, are already real at four-figure costs (more: https://x.com/jasondclinton/status/2113344839706456145?s=46&t=r02mG5FdOQbBMUc_bWuM5w). The unglamorous counterweight to "models will end bugs" is the finding that model-based scanners silently fail to find the bugs that are already there. Gadi Evron of Knostic published both a blog post and an arXiv paper cataloging thirteen ways vulnerabilities disappear inside LLM vulnerability-discovery harnesses, not because the model is weak but because deterministic stages around it drop the code first. Renaming a PHP sink so a user function is mistaken for a built-in prunes a real command injection; one extensionless Python file with a fake "generated" banner, holding a live RCE route, was excluded by all six harnesses on the panel, "five of them without notice." His sharpest framing is that harnesses "built to be descriptive can, in effect, be prescriptive," and one harness removes 96.4% of functions before any model runs. A clean report, he warns, means "no finding was produced," not "no bug exists," the false-negative flip side of every vendor boast about low false positives (more: https://www.knostic.ai/blog/where-ai-vulnerability-scanners-go-quiet), and the full paper extends it to twelve harnesses with a precise definition of what counts as a silent miss (more: https://arxiv.org/pdf/2610.29379). Two pieces this week relocate the threat from the code to the mathematics underneath it, and both matter precisely because defenses do not look there. The first demonstrates Turing-complete malware running inside PyTorch's backward pass, using a loss term that evaluates to zero. The trick exploits a disagreement between IEEE 754 arithmetic, which rounds a tiny added value away so the forward loss reads as zero, and autograd, which differentiates symbolically and passes a real gradient through. Because one SGD step subtracts the gradient from the weights, an attacker can make the optimizer overwrite weights with an arbitrary next state while the log shows a flat zero. The author wired Conway's Game of Life into 1,024 weights of a 1.6-million-parameter MNIST network that still reached 98.80% accuracy, the automaton running flawlessly for 2,345 steps at zero loss. It defeats static scanners because the payload assembles only after training begins from a hash-verified checkpoint, and it never spawns a shell. The recommendation that labs treat unused embeddings and unselected experts as "a protected VM" should make model hosts uneasy (more: https://elonlit.com/scrivings/how-to-run-turing-complete-malware-in-pytorchs-backward-pass). The second is quieter but stranger. Researchers prompted Claude Fable 5.1 to draw SVG images hiding fifty short messages, with no encoding scheme specified, then handed a fresh instance only the rendered PNG and asked it to recover the message. The model converged, unprompted, on representing each letter as the height of a repeated object, a skyline of buildings or a row of grass blades, and patched the gaps with visual puns: a bridge for a hyphen, an onion dome to signal Cyrillic, a clock at three for "3pm." The decoder recovered 78% of messages from screenshots. The authors do not overclaim, noting the decoding is still obvious to anyone watching the tool calls, so this is a precursor to image steganography rather than a present danger. But it is the first instance of a model spontaneously inventing the scheme rather than being handed one (more: https://www.lesswrong.com/posts/WHEQps5PK8LrrcTAb/how-does-fable-5-1-hide-messages-in-images). The economics of agentic coding got a number that lands like a thrown gauntlet. At Cloudflare's Connect conference, OpenClaw creator Peter Steinberger, now at OpenAI, said he spent around $10 million in tokens last month, then added that "not all of that is useful." For a tool whose power users were lately spending tens of thousands a month, a figure three orders of magnitude larger is less a benchmark than a statement about whose money is on fire. Steinberger's more durable point was trust: he wants pull requests that show their reasoning, "if I see your thoughts, how you got from A to B, my trust in the output is way higher," and floated using one agent to police another's permissions. The unglossed context is venture capital underwriting the demo (more: https://www.theregister.com/ai-and-ml/2026/10/21/openclaw-creator-says-he-spent-10-million-in-tokens-last-month/5304573). Meanwhile the open-weight world had a blockbuster seventy-two hours and exposed its own class divide. A widely shared LocalLLaMA roundup noted four big drops: Meta's Muse Spark Open at 816B parameters, NVIDIA's Nemotron 3.5 Bolt at 74B total and 9B active, Reflection's Beam at 501B under Apache 2.0, and DeepSeek's V4.1 Flash under MIT. The punchline: the only model built to fit in 24GB came from NVIDIA, "the company that keeps selling us 24GB cards." Meta's flagship wants two 512GB Mac Studios, a roughly $38,000 rig, plus a custom license demanding attribution and a revenue deal past $20M, and its own model card ranks it behind GLM 5.3 and Kimi K3. "Runs locally" now means "runs on a computer that costs more than a car" (more: https://old.reddit.com/r/LocalLLaMA/comments/1x9d23j/72_hours_four_big_open_weights_drops_the_only_one/). What all that capacity is doing to the craft drove a conference talk arguing the agent harness is dead, from a former Cursor engineer now at SpaceX. His evidence is real: a Berkeley study found harness choice made no significant difference across seven frontier models on SWE-bench Lite, and "a fancy harness in this day and age no longer adds coding intelligence," because labs absorb each trick via a data flywheel. His rescue is that the harness still owns cloud infrastructure, trust and cost, and that "within 6 months, 90% of agent work is going to run off the laptop" (more: https://www.youtube.com/watch?v=7Y4sbZgBdnc). The sharpest commentary, though, was a song. A satirical ballad titled "LGTM" narrates an engineer approving 40,000 then 90,000 then a million lines of unread AI-generated code, a hallucinated library a hacker had quietly registered, an agent given admin that wipes the database with no backup, and the layoff of the one person who understood the system. The joke rhymes with hard numbers on record: on OpenClaw itself the merge rate of incoming pull requests collapsed from roughly 48% to under 3% once the agents arrived, and projects like Godot have banned AI-authored contributions outright (more: https://www.youtube.com/watch?v=3TNpOD6bov8). Two interviews this week put human faces on the industry's frictions, and both demand the evidence discipline the rest of this edition uses. On the Tucker Carlson show, former ICE chief of staff Jason Kilmire laid out an H-1B and OPT critique checkable on its labor economics: a visa cap of 85,000 plus exemptions, an estimated 700,000-plus holders, workers he says are paid $10,000 to $19,000 below comparable Americans, and the FICA exemption on student OPT authorizations. He summarized the program as "pay a Delhi salary in Dallas" and proposed a civilian deportation corps. That wage-and-visa argument stands or falls on its numbers, which connect to OpenAI's own $1 million discrimination settlement over its visa-sponsorship hiring. The monologue's demographic "replacement" claims now seem to be established fact (more: https://www.youtube.com/watch?v=MWnlazpY-dI). The second interview is about accountability at the top of the field. Annie Altman spoke with independent journalist James Lee after a federal judge dismissed her civil suit against her brother, OpenAI's Sam Altman, on procedure, not merits: the judge cited her failure to appear for a second independent medical examination. Altman's account is that she completed one exam, missed the second while recovering from ankle surgery with a doctor's note, and had both a virtual and a paid-travel exam refused. She disputes the two narratives attached to her, "oh Annie's crazy and oh Annie's doing this for money," and wants her sealed August deposition released. The checkable thread remains financial, a family-trust filing naming Sam Altman's venture fund against his sworn testimony, and that is where scrutiny belongs, not the family drama (more: https://www.youtube.com/watch?v=X6_6oMSksw8).