Critical PHP Zero-Days Leaked Before Patch — 70% of Websites at Risk
Two critical unauthenticated remote code execution vulnerabilities in PHP were leaked publicly before patches were available, affecting WordPress, MediaWiki, Magento, Joomla, and Laravel. Security researchers are urging people to avoid critical Web2 interactions.
What we know
An account on X RT'd a detailed breakdown of two critical PHP bugs allowing anyone to run code on a server without logging in, with details leaking before the patch dropped — affecting the entire PHP ecosystem including WordPress and Laravel. Another account on X framed this as 'AI discovers critical security flaw affecting technology behind 70% of all websites.' On the crypto side, another account on X amplified a warning to 'avoid critical web2 interactions right now' as reverse-engineering attacks are being actively used on traditional web apps. Another account on X used the moment to argue the world should just stop using PHP entirely. Additionally, another account on X RT'd news of separately disclosed Linux kernel vulnerabilities with CVSS scores as high as 9.0 also accidentally posted publicly.
How the story developed
Two critical unauthenticated remote code execution vulnerabilities in PHP were leaked publicly before patches were available, affecting WordPress, MediaWiki, Magento, Joomla, and Laravel. Security researchers are urging people to avoid critical Web2 interactions.
A critical PHP vulnerability (9.2/10 severity) is taking websites offline globally, part of a broader 48-hour wave of major security incidents being called 'Black October.' The threat has direct implications for crypto infrastructure, as most airdrop claim pages and wallet-connect sites run on WordPress/PHP.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.