The Web Pulled Its Own Plug #1881

In this episode, Ray Cochrane returns to the studio in Michigan and leads with PHP2Shell. Those two PHP bugs, found with AI help, led sites from DeviantArt to government portals to go dark on purpose. Additionally, he covers OpenAI’s forward-deployed engineers, Anthropic’s Claude Frontier Academy, Apple’s American iPhone suppliers, Euclid’s first comet, and a new date for The Starry Night.
– Want to start a podcast? It’s easy to get started! Sign-up at Blubrry
– Thinking of buying a Starlink? Use my link to support the show.
Subscribe to the Newsletter.
Email Ray if you want to get in touch!
Like and Follow Geek News Central’s Facebook Page.
Support my Show Sponsor: Best Godaddy Promo Codes
Get 1Password
Full Summary
Ray Cochrane opens the show back in the studio, now that he has made it to Michigan. The drive from Oregon took about three days, starting on a Sunday and arriving Tuesday night. Along the way, the trip crossed Idaho, Wyoming, Nebraska, Iowa, Illinois, and Indiana before ending on Brocklebank Road.
Getting the studio running again was a nightmare. Just as he went to record the night before, nothing was coming in on the mic. So he spent the rest of that night, plus a few hours the next day, digging through wires until he finally got it figured out. A little feedback may still be on the line, but he feels blessed to be recording in the studio again.
Life in Michigan has been nice but a little weird. Cochrane usually stays only a short time, so part of his brain is still in leaving-soon mode. Meanwhile, video viewers get a new format, with a presenter mode that lets them follow along.
On the lead story, Cochrane’s team spent a few days upgrading servers to fix the PHP bug. Even so, the news came as a shock. Moreover, he expects many more bugs like it, since AI systems now hunt for flaws around the clock. He hopes this is the first of many cleanups of the major bugs in today’s systems.
PHP2Shell: The Bugs That Made the Web Pull Its Own Plug
The lead story comes from Ars Technica, which ran a Financial Times report on October 22. That week, a big slice of the web switched itself off on purpose. DeviantArt went dark for a while, and 4chan stopped taking new posts. Meanwhile, governments in Europe and Canada took sites offline until they could patch them.
The cause was a pair of security holes in PHP, the server-side language behind WordPress, Wikipedia, and Drupal. W3Techs data puts PHP on about 69 percent of sites where the language can be identified. Researchers nicknamed the bugs PHP2Shell. They allow remote code execution, so a stranger with no login can run commands on the server underneath.
Security firm Calif says it used the flaws to take over 11 web apps without logging in, including WordPress and MediaWiki. Wiz, another security firm, called the potential attack surface “enormous.” PHP rated both bugs 9.2 out of 10, which counts as critical. Still, an attacker needs a few conditions to line up first.
How the Bugs Work and Who Needs to Patch
Both bugs come down to memory, a classic programming headache. A PHP server reuses the same worker for request after request, and each request gets a memory cap. With the first bug, an attacker forces that cap to hit mid-job, and the cleanup then trusts something half-built. The second is a use-after-free bug: one request sets a trap, and the next one springs it.
Almost every way of running PHP was affected, and Apache’s mod_php on default settings was the worst case. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and servers need a restart after updating. Versions older than 8.2 get no new releases, only bare-bones source patches back to 7.4. As a result, Cochrane urges anyone still below 8.2 to upgrade, and CISA says to take anything unpatchable offline.
The flawed code dates back to 2012. According to the PHP Foundation, a contractor spotted the underlying memory problem in 2024, but the fix stalled. The Guardian reports the foundation has just 13 engineers...