Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

PHP media sweep 2026-10-30T0630Z

kind
working record (discovery; unreviewed; not a study)
date
2026-10-30

PHP media sweep, 2026-10-30T0630Z

Eighth sweep under the fixed plan, and the fifth of the once-a-day schedule. Run by a Sonnet sub-agent for the driving session. Discovery only: it finds leads, measures nothing and estimates no coverage. Compared against every earlier sweep file: 2026-10-24T0830Z.md, 2026-10-24T1830Z.md, 2026-10-25T0630Z.md, 2026-10-26T0630Z.md, 2026-10-27T0630Z.md, 2026-10-28T0630Z.md and 2026-10-29T0630Z.md.

  • Searches run: 2026-10-30, shortly before 06:35 UTC. The six queries were sent in the plan's order, standard mode, one search each, no retry. The tool is US-only and English.
  • Pages read: four attempted with WebFetch, one request each; three read, one failed (HTTP 403). All at about 06:35 UTC. Nothing was saved.
  • Comparison: by normalised URL (scheme, leading "www." and trailing slash dropped) against every URL in the seven earlier sweep files. 79 results returned (10, 7, 7, 15, 20 and 20 per query); 78 distinct URLs (silicon.co.uk appears under queries 4 and 6); 28 are new, 50 repeat.

Results as returned

Titles are as the tool gave them. [new] marks a URL in no earlier sweep file.

1. PHP vulnerability exploited in the wild

  1. www.bleepingcomputer.com (amp): https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/amp/
  2. From zdnet.com: https://cert.bournemouth.ac.uk/?p=5514
  3. Exploits in the wild for several PHP-based web apps: https://isc.sans.edu/diary/954
  4. (same title) https://dshield.org/diary/954
  5. Web Sites Open to Attack From PHP Scripting Holes: https://adtmag.com/articles/2012/05/08/php-scripting-holes.aspx
  6. Multiple vulnerabilities in PHP: https://cybersecurity-help.cz/vdb/SB2023080604
  7. experts warn of mass exploitation of critical php flaw cve 2024 4577: https://securityaffairs.com/175198/hacking/experts-warn-of-mass-exploitation-of-critical-php-flaw-cve-2024-4577.html
  8. PHP2Shell Exploitation: Two Critical PHP Flaws Explained (Recorded Future): https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
  9. php cgi exploit is in the wild get protected asap: https://blog.willchatham.com/2012/05/08/php-cgi-exploit-is-in-the-wild-get-protected-asap/
  10. CVE 2012 2376: https://exploit-intel.com/vuln/CVE-2012-2376

No new URLs. Tool summary (lead): BleepingComputer reports CVE-2026-109618 and CVE-2026-109619 "successfully exploited in the wild", citing a researcher's breakdown of an attack on Apache mod_php, PHP 8.4.26; CISA had not flagged exploitation but shared a detection rule; Recorded Future cautions that public code does not establish that it works. The tool adds older flaws (CVE-2024-4577, CVE-2012-2376, a 2012 PHP-CGI flaw) with exploitation.

2. PHP2Shell

  1. php2shell exploit confirmed 35 shells honeypot: https://pasqualepillitteri.it/en/news/27254/php2shell-exploit-confirmed-35-shells-honeypot
  2. PHP2Shell - what it is, how to detect, how to patch: https://pentest-tools.com/research/php2shell-rce
  3. [new] Cos'è PHP e perché le sue ultime due falle hanno causato l'oscuramento di tanti siti in Europa e non solo (Italian): https://www.smartworld.it/news/php2shell-falla-php-siti-oscurati.html
  4. php2shell ataque confirmado 35 shells honeypot (Portuguese): https://pasqualepillitteri.it/pt/news/27261/php2shell-ataque-confirmado-35-shells-honeypot
  5. By Aamir Lakhani | October 23, 2026: https://www.fortinet.com/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch
  6. By Aamir Lakhani | 23/10/2026: https://www.fortinet.com/uk/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch
  7. [new] (Hebrew wiki page, title "skip to content"): https://www.hamichlol.org.il/PHP2Shell

Tool summary (lead, unread): names Adel Karimi as reporting 35 system shells spawned by Apache processes, from two hosting addresses, on three decoy servers running PHP 8.4.26; says Amazon reportedly saw an attempt on 17 October while Cloudflare, "as of that day", had not identified active exploitation; Censys's 22 October snapshot found about 36.7 million internet-facing services reporting potentially affected PHP versions; Fortinet released virtual patches; Italy's national cybersecurity agency scored it 9.2.

3. PHP session upload progress vulnerability CVE-2026-115560

  1. Nuova vulnerabilità PHP CVE-2026-115560, spegni l'upload progress (Italian): https://pasqualepillitteri.it/news/26591/php-cve-2026-115560-spegni-upload-progress
  2. CVE-2026-115560: Another PHP Session-Handler RCE: https://www.getastra.com/blog/?p=49824
  3. PHP discovers new remote code execution flaw but rules out emergency fix: https://www.computing.co.uk/news/2026/security/php-finds-new-remote-code-flaw-no-fix
  4. PHP's nightmare is far from over: new unpatched vulnerability found: https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/
  5. php cve 2026 115560 turn off session upload progress: https://pasqualepillitteri.it/en/news/26592/php-cve-2026-115560-turn-off-session-upload-progress
  6. PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches: https://securityaffairs.com/?p=201595
  7. [new] PHP CVE-2026-115560 only hits apps that switch serialize_handler to php at runtime: https://lilting.ch/en/articles/php-cve-2026-115560-serialize-handler

Tool summary: disclosed 23 October in an informational advisory; the setup is called unlikely, so a routine release, not an emergency one; the exploit path needs session.serialize_handler set to php_binary or php_serialize, switched to php at runtime before session_start(), with session upload progress enabled; mitigation session.upload_progress.enabled=0; the 21 October releases do not fix it; no affected version ranges or CVSS published as of 23 October; one source reports no exploitation. The tool says it did not verify against php.net.

4. PHP vulnerability websites taken offline

  1. Factbox-Governments, companies take websites offline over PHP flaws: https://www.internazionale.it/ultime-notizie-reuters/2026/10/22/factbox-governments-companies-take-websites-offline-over-php-flaws
  2. Factbox-Websites taken offline over PHP risks: https://www.thestar.com.my/tech/tech-news/2026/10/21/factbox-websites-taken-offline-over-php-risks
  3. Govts, companies take websites offline over PHP flaws: https://www.koreatimes.co.kr/world/20261023/governments-companies-take-websites-offline-over-php-flaws
  4. [new] What's the PHP coding flaw that could pull down 70 percent of the internet? (Al Jazeera): https://www.aljazeera.com/news/2026/10/22/whats-the-php-coding-flaw-that-could-pull-down-70-percent-of-the-internet
  5. theprint.in: https://theprint.in/world/factbox-governments-companies-take-websites-offline-over-php-flaws/3078821/
  6. nltimes.nl: https://nltimes.nl/node/92563
  7. exposure global cyber security warning cloudflare: https://www.lbc.co.uk/tech/exposure-global-cyber-security-warning-cloudflare/
  8. Critical PHP vulnerabilities force government websites offline across Europe: https://jang.com.pk/en/74964-critical-php-vulnerabilities-force-government-websites-offline-across-europe-news
  9. php patch 631972: https://www.silicon.co.uk/cybersecurity/php-patch-631972
  10. Websites pulled offline worldwide as AI finds critical security flaws: https://www.scmp.com/news/world/article/3371694/websites-go-dark-worldwide-ai-exposes-critical-security-flaws
  11. [new] australian businesses pull websites offline over php threat: https://www.smartcompany.com.au/information-technology/australian-businesses-pull-websites-offline-over-php-threat/
  12. [new] Governments and Organizations Take Sites Offline to Patch Web Vulnerability: https://www.pymnts.com/?p=4329059
  13. [new] What is PHP and why did it take government websites offline?: https://arynews.tv/what-is-php-and-why-did-it-take-government-websites-offline
  14. [new] Critical PHP flaws put millions of websites at risk as governments pull sites offline: https://katv.com/news/nation-world/critical-php-flaws-put-millions-of-websites-at-risk-as-governments-pull-sites-offline
  15. [new] PHP flaws: Bangladesh Bank, land services, six banks' websites remain offline: https://en.prothomalo.com/science-technology/it/b25g8qgplr

Tool summary: shutdowns on 21 and 22 October, mostly precautionary (Netherlands, Finland's Valtori, Germany's ITZBund, France, Australia, Bangladesh; Wikipedia's operator and the Internet Archive); Belgium's foreign ministry closed sites "following reports of cyberattacks exploiting the PHP vulnerabilities" while Belgium's cybersecurity centre "had not recorded any attacks"; the NSA advised disabling sites that cannot be patched at once. New this time: Bangladesh Bank and several commercial banks kept sites down "into the following weekend" (Prothom Alo, unread).

5. PHP vulnerability AI discovered Gemini OpenAI Wiz

  1. OpenAI says AI found one of the biggest web weaknesses ever: https://www.forbes.com.au/?p=211107
  2. (same title) https://www.forbes.com.au/news/innovation/openai-says-ai-found-one-of-the-biggest-web-weaknesses-ever/
  3. govt websites go dark after ai discovered flaw sparks security scramble 5641112: https://www.monitor.co.ug/uganda/news/world/govt-websites-go-dark-after-ai-discovered-flaw-sparks-security-scramble-5641112
  4. kuwaittimes.com: https://kuwaittimes.com/article/52121/world/websites-go-dark-as-ai-exposes-critical-security-flaws/amp
  5. thenewstack.io: https://thenewstack.io/?p=22841241
  6. eu.36kr.com: https://eu.36kr.com/en/p/4036210178134916
  7. (title as returned, "Laptop computer engulfed in flames"): https://techcrunch.com/?p=3180197
  8. GS 3: Science & Technology (current-affairs digest): https://superkalam.com/current-affairs/22-10-2026/govt-sites-go-dark-after-ai-discovered-flaw-sparks-security-scramble-pg16-dee1a834-7eaa-4172-9794-c0625d2b515c
  9. Gemini and GPT Helped Find PHP Flaws in Up to 70% of Sites: https://fourweekmba.com/ai-gemini-and-gpt-helped-find-php-flaws-in-up-to-70-of-sites/
  10. [new] Ofri Markevitch (LinkedIn profile): https://il.linkedin.com/in/ofri-markevitch
  11. AI tools uncover old PHP flaw causing global service outages: https://www.newsbytesapp.com/news/science/ai-tools-uncover-old-php-flaw-causing-global-service-outages/tldr
  12. [new] www.communicationstoday.co.in: https://www.communicationstoday.co.in/?p=426281
  13. [new] Vulnerability hidden for over 10 years found with AI assistance: https://biz.heraldcorp.com/article/10910643
  14. [new] www.thenewslens.com: https://www.thenewslens.com/article/270684
  15. [new] PHP2Shell: How AI Found a 14-Year-Old Bug in PHP, and Why the Patch Race Is On: https://pub.towardsai.net/php2shell-how-ai-found-a-14-year-old-bug-in-php-and-why-the-patch-race-is-on-70635fdf7b7e
  16. [new] php2shell flaws websites risk: https://www.timesofai.com/news/php2shell-flaws-websites-risk/
  17. [new] (Kyunghyang Shinmun, English): https://www.khan.co.kr/en/article/202610221747027
  18. [new] PHP vulnerability: How Google and OpenAI broke the web to save it: https://yourstory.com/ai-story/php-vulnerability-google-openai-web-security
  19. openai says gpt 5 6 sol found a php flaw before attackers did: https://ppc.land/openai-says-gpt-5-6-sol-found-a-php-flaw-before-attackers-did/
  20. [new] techjacksolutions.com: https://techjacksolutions.com/?p=99319

Tool summary: as before (Calif with GPT-5.6 Sol; Wiz independently with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; a Wiz co-founder quoted as saying "the most serious security vulnerability ever discovered by AI"). It says one source has hackers exploiting before the patch while another says "OpenAI says that these flaws were found by researchers before hackers discovered them", and that it could not resolve this. Model names unverified. The tool names the PHP advisory (dated 2026-10-21) and Wiz's post at wiz.io/blog/php2shell-php-rce as the primary references.

6. PHP vulnerability affected products vendors patch

  1. Incident Response (SecurityWeek, amp): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/amp/
  2. Connect with us (SecurityWeek, non-amp): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/
  3. PHP vulnerabilities quickly patched on October 21 (AEB): https://www.aeb.com/en/magazine/articles/php-update.php
  4. NSA recommends PHP patching: https://intelligencecommunitynews.com/?p=45876
  5. Last revised: --: https://vuls.cert.org/confluence/x/4gDDBQ
  6. [new] tns 2018 03 (Tenable, 2018): https://jp.tenable.com/security/tns-2018-03
  7. PHP Arena Affected (2005 CERT vendor note): https://kb.cert.org/vuls/vendor/VU%23459565
  8. PHP Vulnerabilities Response Center (PTC): https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/php2shell
  9. Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0818
  10. Tenable products affected by PHP < 5.5.21 / 5.4.37 (2015): https://de.tenable.com/security/tns-2015-02
  11. [new] Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-1007
  12. [new] php2shell affected products list: https://securityonline.info/php2shell-affected-products-list/
  13. php patch 631972: https://www.silicon.co.uk/cybersecurity/php-patch-631972
  14. [new] Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0468
  15. [new] Action not permitted: https://cve.circl.lu/vuln/certfr-2024-avi-1007
  16. [new] NSA Says Take PHP Offline if You Cannot Patch, but Some Vendor Fixes Land in 2027: https://www.shashi.co/2026/10/nsa-says-take-php-offline-if-you-cannot.html
  17. [new] Action not permitted (CERT-FR 2025 item): https://db.gcve.eu/vuln/certfr-2025-avi-0209
  18. [new] PHP three vulnerabilities 40524 (Vigilance): https://vigilance.fr/vulnerability/PHP-three-vulnerabilities-40524
  19. [new] Itdaily - PHP2Shell: Major PHP vulnerability actively exploited ahead of patch availability: https://itdaily.com/blogs/software/php2shell-bug-php/
  20. [new] Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0300

Tool summary (lead, unread): QNAP lists affected products in advisory QSA-26-18; Synology's affected item is the end-of-life PHP 7.3 package; Sophos said its MyUTM licensing portal ran an affected PHP version and took it offline on 21 October; Cisco "no products are known to be affected"; Broadcom has not confirmed any Enterprise Security Group product; Duo Access Gateway fix available; Expressway fixed version 15.5.21 with no date; Check Point Security Management and Log Servers affected, with remote code execution as root; UK NCSC says discovery should cover every PHP installation; one list reflects vendor statements as of 25 October. The tool notes that the other results are older, unrelated advisories.

Totals: 79 results, 78 distinct URLs; 28 new, 50 repeated.

New since earlier sweeps

Twenty-eight distinct URLs, marked in the results above:

  • Query 2: smartworld.it, hamichlol.org.il.
  • Query 3: lilting.ch.
  • Query 4: Al Jazeera, SmartCompany, PYMNTS, ARY News, KATV, Prothom Alo.
  • Query 5: Ofri Markevitch LinkedIn profile, Communications Today, Herald Corp, The News Lens, Towards AI, Times of AI, Kyunghyang Shinmun (khan.co.kr), YourStory, TechJack Solutions.
  • Query 6: Tenable tns-2018-03, four further CERT-FR mirror items (gcve 2024-avi-1007, 2024-avi-0468, 2025-avi-0209, 2024-avi-0300; circl 2024-avi-1007), securityonline.info, shashi.co, Vigilance, Itdaily.

Several of these (the CERT-FR and Tenable items) are older, unrelated advisories.

Which pages were opened

The four highest-ranked new results that make a claim of fact, taken in query order: smartworld.it (query 2, rank 3), hamichlol.org.il (query 2, rank 7), lilting.ch (query 3, rank 7) and Al Jazeera (query 4, rank 4). Skipped as lower-ranked or not a claim of fact: SmartCompany, PYMNTS, ARY, KATV and Prothom Alo (query 4); the LinkedIn profile and the other query 5 items; the query 6 items, including shashi.co, securityonline.info and Itdaily, which ranked below the four. One request each, no retry. WebFetch returns a small model's answer to a prompt, not the page text, so the quotations are unverified wording.

Pages read

A. SmartWorld: what PHP is and why its latest two flaws darkened sites in Europe (Italian)

  • URL: https://www.smartworld.it/news/php2shell-falla-php-siti-oscurati.html
  • Read: 2026-10-30 at about 06:35 UTC, page returned. Page's own date: 22 October 2026, 16:57.
  • Claims, each reported by the page:
    • It reports that Italy's national cybersecurity agency (ACN) rated both flaws critical, 9.2 out of 10, and, citing Wiz Research, that an attacker can take control of the PHP process without credentials, and that every PHP version from 5.4 on is affected by at least one flaw. Primary source named: Wiz Research.
    • It reports precautionary shutdowns by Germany's ITZBund, Italy's Interior Ministry (prefecture sites), the Belgian foreign ministry and Canton Ticino; the NSA urging patching or disconnection; and Cloudflare deploying free protection rules. It states exploitation of the flaws against sites as a capability ("allows running arbitrary commands"), not as an observed attack.
    • Figures it attributes: PHP on 69.3% of sites with a known server-side language (W3Techs); about 22 million exposed platforms (Palo Alto Networks); about one in three PHP sites on version 7 or 5 (W3Techs). It says the flaws were found by Wiz and Calif.io with AI tools, including OpenAI models, under a "Patch the Planet" programme.
    • It does not mention CVE-2026-115560, and carries no CVE identifiers.

B. Hamichlol: PHP2Shell (Hebrew wiki page)

C. Lilting: CVE-2026-115560 only hits apps that switch serialize_handler to php at runtime

  • URL: https://lilting.ch/en/articles/php-cve-2026-115560-serialize-handler
  • Read: 2026-10-30 at about 06:35 UTC, page returned. Page's own date: 23 October 2026, updated 26 October 2026.
  • Claims, each reported by the page, which says it summarises PHP's notice:
    • It reports that exploitation needs all three of: session.serialize_handler set to php_binary or php_serialize; the application switching back to php with ini_set() before session_start(); and session.upload_progress.enabled still on. Quotation (PHP's wording as relayed): "unusual and unlikely in practice."
    • It reports that affected versions were unpublished as of 23 October and still as of 26 October; that the 21 October releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) do not fix it; that the fix will come in "the next regular bugfix release"; and that CVE.org had no record as of 26 October. Primary source named: PHP's "Informational advisory: Session upload progress" (php.net news archive).
    • It reports no exploitation of this CVE as of 23 October, and that attacks seen since 21 October "target the two flaws fixed on October 21". Mitigation: session.upload_progress.enabled=0, which PHP says needs no further action where already applied for CVE-2026-109619.
    • It names three further sources: The Hacker News, Red Hat bulletin RHSB-2026-013 (said to state that the setting "fully protects" against it) and JPCERT/CC alert JPCERT-AT-2026-0033. Not read.

D. Al Jazeera: What's the PHP coding flaw that could pull down 70 percent of the internet?

  • URL: https://www.aljazeera.com/news/2026/10/22/whats-the-php-coding-flaw-that-could-pull-down-70-percent-of-the-internet
  • Read: 2026-10-30 at about 06:35 UTC, page returned. Page's own date: 22 October 2026.
  • Claims, each reported by the page:
    • It reports that Amazon's CJ Moses said his team saw an exploitation attempt on 17 October, four days before public disclosure, and that it was unclear how the attacker learned of the flaws; details leaked on 21 October before fixes were ready. Primary source named: Amazon (Moses). This is an attempt, not a compromise.
    • It reports that Calif, working with OpenAI, reported the first flaw on 11 August and Wiz reported the second on 24 August; both scored 9.2; PHP 5.4 and later are affected (per Calif, Wiz and Cloudflare); PHP released fixes on Wednesday (21 October).
    • Operator actions it reports: the Dutch cybersecurity agency, Port of Rotterdam and KNVB offline; Finland's Valtori; France's Interior Ministry in "preventive maintenance"; Belgium's foreign affairs service offline while its cybersecurity centre recorded no attacks; South Korean guidance to about 28,000 companies; Wikipedia's operator took unspecified systems down; the Internet Archive briefly offline.
    • It does not mention CVE-2026-115560 and names no CVE numbers.

Triage

Leads for the driving session (none read under a protocol):

  • PHP's "Informational advisory: Session upload progress" at php.net, the primary source for CVE-2026-115560, named by page C; also Red Hat RHSB-2026-013 and JPCERT-AT-2026-0033. These would settle the scope and the conditions.
  • Amazon's CJ Moses (Amazon Threat Intelligence) for the 17 October attempt, named by page D.
  • Query 6 summary (unread, from the tool): vendor statements from QNAP (QSA-26-18), Synology, Sophos (MyUTM portal offline 21 October), Cisco, Broadcom, Check Point and Cisco Expressway (fixed version 15.5.21, no date). Sophos and Check Point are named in no earlier sweep file; vendor advisories are the primary sources.
  • Query 2 summary: Censys's 22 October snapshot (about 36.7 million services), already a lead in the 24 October sweep.
  • Itdaily ("actively exploited ahead of patch availability"), shashi.co ("some vendor fixes land in 2027") and Prothom Alo (Bangladesh Bank and banks still offline): new, unread.

Not pursued: the older-flaw results in queries 1 and 6; the CERT-FR, Tenable and other older advisories; the Hebrew wiki page (403); language and mirror variants.

For the daily log

Nothing new and consequential: pages A, C and D restate, with dates and attributions, claims already in earlier sweep files or in the tool's earlier summaries.

Would change the public account, flag for review (primary source to be read first):

  • Compromise: none claimed on a page read today. The query 4 tool summary repeats the Belgian foreign ministry's closure "following reports of cyberattacks", beside Belgium's cybersecurity centre recording none. Already in earlier sweep files; page D carries the same pair.
  • Exploitation with a stated source: page D reports Amazon's CJ Moses on a 17 October attempt, an attempt and not a compromise. The Amazon 17 October attempt was already in the 29 October file. The Karimi honeypot claim and the "35 shells" figure appear in today's query 2 summary only; both were already in the 29 October file.
  • Version scope or fix for CVE-2026-115560: nothing new. Page C and the query 3 summary repeat no published version range and no fix, with the fix planned for the next regular bugfix release; the same position was in the 29 October file. New detail: the exploit conditions (serialize handler switched at runtime) and the Red Hat and JPCERT citations, which no earlier sweep file mentions, but they are second-hand until the PHP advisory is read.
  • Vendor scope (query 6 summary): Sophos MyUTM, Check Point and Expressway are new to the sweep files, from the tool's summary only, unread.

Waits for the keeper (AGENTS.md): nothing.

Limits

One search tool's ranking, on one day, in English: what it returns depends on its index and on wording, and an absence means nothing. Media restate each other; a claim repeated by many outlets is one claim. The tool's summaries are the tool's, not a reading of the pages, and are not evidence. WebFetch answers through a small model, so the quotations are unverified. Page B was not read (HTTP 403).

From notes/php-media-sweep/2026-10-30T0630Z.md in the repository, last changed 30 October 2026.