Please Apply The Critical Hotfix

The internet just got patched. Did you?

Two critical bugs hid inside PHP for over a decade. AI found them in August, and by October the whole web had to hotfix at once. $PATCH is the ticker for that week.

CA Drops at launch
Pump.fun X Community

One request. Full takeover.

PHP2Shell is the nickname for two unauthenticated remote code execution bugs in the PHP engine itself. Not a plugin, not a theme. The core. A stranger could send a crafted request and run code on the server. No login, no password.

People started calling the month Black October and Bugmageddon. This is the part where you check your PHP version.

~70%
of websites are estimated to run PHP
10+ yrs
the flaws reportedly sat in the code
9.2
severity score out of 10, rated critical

Patch notes

How a decade-old bug became everybody's week.

  • AUG 2026

    Found

    AI models dig up two critical flaws in the PHP core. Researchers at Calif and at Wiz land on them independently. Humans had walked past this code for years.

  • AUG TO OCT

    Quiet fix

    PHP maintainers, Wiz, Cloudflare and OpenAI work on patches in silence for about two months, so attackers don't get a head start.

  • OCT 20-21

    PHP2Shell goes public

    Two critical bugs, disclosed. Nearly every PHP version from 5.4 up to 8.5 is in the blast radius.

  • OCT 21

    Hotfix ships

    PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The only complete fix is updating.

  • OCT 21 ON

    Chaos

    Cloudflare reports millions of attack attempts per minute. Some European governments pull sites offline to patch. The FBI and GCHQ tell everyone to update now.

  • TODAY

    $PATCH deploys

    Please Apply The Critical Hotfix. Ship it.

What the ticker stands for

Five letters. One instruction.

Please
Apply
The
Critical
Hotfix