NSA Just Told PHP Sites to Unplug #php #security #programming

PHP2Shell is two bugs in PHP itself, rated 9.2 out of 10, and Wiz says every PHP version from the last decade is exposed to one of them, even a Hello World app, so the NSA told anyone who can't patch to take their systems offline. Before the fix shipped, the CVE numbers hit Hacker News, an exploit video went up by mistake, and Chainguard published patched images early, which the PHP Foundation says broke the embargo.