{"id":"1792836147846-money-segment","slug":"php2shell-flaws-prompt-urgent-patch-warning","title":"PHP2Shell flaws prompt urgent patch warning","summary":"Two critical PHP remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, were disclosed after leaking early. They affect PHP versions 5.4 through 8.5 and were rated 9.2 severity. PHP released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. U.S. agencies including CISA, NSA, and FBI urged immediate patching or taking affected systems offline.\n\nThe flaws were found via AI-assisted research by Calif and Wiz, leaked on October 20 ahead of planned disclosure, and prompted a fast patch cycle. Exploitation attempts appeared quickly, including attempts detected by Amazon before public disclosure.\n\nPolymarket has a market titled “US Gov confirms PHP2Shell exploited by...?” asking whether the U.S. government will confirm exploitation; the post itself does not claim the government has confirmed exploitation.","publishedAt":"2026-10-24T10:02:27.846Z","channel":{"id":"money","name":"Oncast Money","language":"en"},"show":"Morning Brief","verification":{"status":"verified","leadVerdict":"TRUE","notes":"TRUE: Polymarket has a market titled “US Gov confirms PHP2Shell exploited by...?” asking whether the U.S. government will confirm exploitation; the post itself does not claim the government has confirmed exploitation.\nSource: [polymarket.com](https://polymarket.com/es/event/us-gov-confirms-php2shell-exploited-byptptpt) NAMES: Polymarket = decentralized prediction-market platform; PHP (https://x.com/Polymarket/status/2113924961060700466)","claims":[{"verdict":"TRUE","summary":"Polymarket has a market titled “US Gov confirms PHP2Shell exploited by...?” asking whether the U.S. government will confirm exploitation; the post itself does not claim the government has confirmed exploitation.","sourceName":"[polymarket.com](https://polymarket.com/es/event/us-gov-confirms-php2shell-exploited-byptptpt) NAMES: Polymarket = decentralized prediction-market platform; PHP","sourceUrl":"https://x.com/Polymarket/status/2113924961060700466","claim":"🚨 NEW POLYMARKET: US Gov confirms PHP2Shell exploited by...? https://t.co/MVtADQJYLb","author":"@Polymarket"}]},"sources":[{"url":"https://x.com/Polymarket/status/2113924961060700466","name":"[polymarket.com](https://polymarket.com/es/event/us-gov-confirms-php2shell-exploited-byptptpt) NAMES: Polymarket = decentralized prediction-market platform; PHP","kind":"x","verdict":"TRUE","author":"@Polymarket"}],"url":"https://oncast.fm/story/1792836147846-money-segment-php2shell-flaws-prompt-urgent-patch-warning","listenUrl":"https://oncast.fm/c/money","attribution":{"publisher":"Oncast","site":"https://oncast.fm","url":"https://oncast.fm/story/1792836147846-money-segment-php2shell-flaws-prompt-urgent-patch-warning","cite":"Cite https://oncast.fm/story/1792836147846-money-segment-php2shell-flaws-prompt-urgent-patch-warning and the original source links. Fact-check by Oncast (oncast.fm)."},"hostsSaid":[{"host":"Adam","text":"Good morning, it's Saturday, six o'clock Eastern, and the overnight story is a security scramble for a huge chunk of the web."},{"host":"Adam","text":"Polymarket, the prediction market, just listed a market asking whether the U.S. government will confirm PHP2Shell was exploited."},{"host":"Adam","text":"That's a question, not a confirmation."},{"host":"Bill","text":"And it's already the headline on half the dashboards."},{"host":"Bill","text":"Here's what we actually know: two critical PHP vulnerabilities, rated nine-point-two severity, affect PHP versions five-point-four through eight-point-five."},{"host":"Adam","text":"PHP released patched versions for the affected branches on October twenty-first."},{"host":"Adam","text":"CISA, the NSA, and the FBI all said patch immediately."},{"host":"Bill","text":"The NSA went further: unpatched systems should be taken offline, because the flaw is a direct path to compromise."},{"host":"Adam","text":"Amazon says it saw exploitation attempts as early as October seventeenth, before public disclosure."},{"host":"Bill","text":"Before anyone says the internet is on fire— Sophos retracted its earlier report of successful exploitation."},{"host":"Adam","text":"Right. As of Friday, scanning and failed attempts, but no confirmed mass exploitation."},{"host":"Bill","text":"Google's threat intel lead called it viable and very serious."},{"host":"Adam","text":"So the real headline isn't panic. It's patch now, especially if you run PHP on anything public."},{"host":"Bill","text":"And PHP still runs a huge chunk of the web, including a lot of WordPress."},{"host":"Adam","text":"I get why agencies are loud, but I'm not canceling my Saturday over a flaw with no confirmed mass exploitation."},{"host":"Bill","text":"You don't have to be breached for a nine-point-two remote-code-execution flaw to be urgent."},{"host":"Adam","text":"The take offline line from NSA just feels unusually aggressive."},{"host":"Bill","text":"Because if it does get exploited, the cleanup is worse than a Saturday patch."},{"host":"Adam","text":"Fair. The flaws were found with AI-assisted research by researchers at Calif and Wiz, and they leaked before the planned disclosure."},{"host":"Bill","text":"That leak is why the patch cycle felt rushed."},{"host":"Adam","text":"So, quick clear takeaway: patch, or isolate, anything public running PHP."},{"host":"Bill","text":"And keep an eye on whether that Polymarket market actually resolves."},{"host":"Bill","text":"Different corner of the internet: crypto accounts are arguing with themselves about Bitcoin ETF flows this morning."},{"host":"Bill","text":"Two Bit Crypto posted total inflows slowed from five hundred twenty-seven million dollars to just twenty-three million."},{"host":"Bill","text":"Gwaendy Jn Baptiste posted BlackRock's spot Bitcoin ETF alone pulled in six hundred sixty-four million in a single day."},{"host":"Bill","text":"Gogo Green Shedrack posted five hundred twenty-six million in total inflows."},{"host":"Adam","text":"Those can't all be right if they're talking about the same day."},{"host":"Adam","text":"And we couldn't independently confirm any of those numbers."},{"host":"Bill","text":"We'll ignore the rally-or-crash takes until official flow data lands."},{"host":"Adam","text":"There's also a claim from Blockbuzz Hunter that Switzerland approved its first retail spot Bitcoin ETF."},{"host":"Adam","text":"No official confirmation from the Swiss regulator, so treat that as rumor for now."},{"host":"Bill","text":"If FINMA actually confirms it, that's a real story. Until then, it's just a headline."},{"host":"Adam","text":"And the price posts are just as noisy: some say Bitcoin reclaimed eighty-three thousand, others say it's falling toward eighty."},{"host":"Bill","text":"This is why Saturday morning is better for coffee than for trusting unverified posts."},{"host":"Adam","text":"We'll stick to patching PHP and watching for official numbers."}]}