Yesterday.
Two critical flaws in PHP.
CVE-2026-109618 and CVE-2026-109619.
Both CVSS 9.2.
Unauthenticated remote code execution.
One crafted request could be enough.
PHP runs under a large part of the web.
WordPress, Magento, Laravel, Drupal, MediaWiki — all of them.
Estimates ranged from “more than 40 percent” to “roughly 70 percent.”
There is no exact measurement.
The impact is real.
What happened
Details leaked early.
Cloudflare saw attacks before the patch was out.
Finland took government services offline.
The Netherlands did the same with, among others, the NCSC site and the Tweede Kamer.
France, Japan, parts of the United Kingdom: sites down, or on hold.
The patch arrived Wednesday afternoon.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Older versions get nothing more.
Anyone still running those stays open.
Sansec and others expected mass attacks within minutes of the release.
Whether that happened, and at what scale, has not yet been hard-counted.
The race has started.
The point
A language that sits everywhere has one set of holes.
Those holes stood open for years.
The patch is out.
Systems that do not patch keep the front door open.
This is not an incident at one company.
This is the infrastructure itself.
OIM way out
The OIM site does not run on PHP.
GitHub, Jekyll, Liquid, Python, JavaScript.
Static where it can be.
Open source.
No shared runtime that spreads one flaw across half the internet.
Not because it is perfect.
Because the dependency is smaller.
And the hash is on it.
Whoever does not have the node has the brochure.
Whoever shares the runtime with everyone shares the flaw too.
Question for you
How many sites you visited today are still running the old version?
And who checks whether they are patched or not?
This post is 100% authentic and verifiable via:
https://openinternetmanifest.org/nl/hash-verifier
### RVN: PHP2Shell – the door was open
Yesterday.
Two critical flaws in PHP.
CVE-2026-109618 and CVE-2026-109619.
Both CVSS 9.2.
Unauthenticated remote code execution.
One crafted request could be enough.
PHP runs under a large part of the web.
WordPress, Magento, Laravel, Drupal, MediaWiki — all of them.
Estimates ranged from “more than 40 percent” to “roughly 70 percent.”
There is no exact measurement.
The impact is real.
### What happened
Details leaked early.
Cloudflare saw attacks before the patch was out.
Finland took government services offline.
The Netherlands did the same with, among others, the NCSC site and the Tweede Kamer.
France, Japan, parts of the United Kingdom: sites down, or on hold.
The patch arrived Wednesday afternoon.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Older versions get nothing more.
Anyone still running those stays open.
Sansec and others expected mass attacks within minutes of the release.
Whether that happened, and at what scale, has not yet been hard-counted.
The race has started.
### The point
A language that sits everywhere has one set of holes.
Those holes stood open for years.
The patch is out.
Systems that do not patch keep the front door open.
This is not an incident at one company.
This is the infrastructure itself.
### OIM way out
The OIM site does not run on PHP.
GitHub, Jekyll, Liquid, Python, JavaScript.
Static where it can be.
Open source.
No shared runtime that spreads one flaw across half the internet.
Not because it is perfect.
Because the dependency is smaller.
And the hash is on it.
Whoever does not have the node has the brochure.
Whoever shares the runtime with everyone shares the flaw too.
**Question for you**
How many sites you visited today are still running the old version?
And who checks whether they are patched or not?
#PHP #PHP2Shell #CVE #Security #OIM #RealityVsNarrative #RVN #OpenInternetManifest
https://openinternetmanifest.org
This post is 100% authentic and verifiable via:
https://openinternetmanifest.org/nl/hash-verifier
Deel dit bericht
Korte versie: Teaser voor X Raw Markdown: Exacte originele tekst (voor verifier) Unicode: Mooie opmaak voor Facebook / andere platforms
Comments
Want to comment? Log in with GitHub.
You can always read without an account.
💸 Support the Open Internet Manifest ❤️
This manifest only exists thanks to your donations.
Every satoshi or monero helps enormously (servers, domains, development).
Comments
Want to comment? Log in with GitHub.
You can always read without an account.