Trust Me Bro Then Websites Went Offline (The php2shell story) | Threat Wire

Trust Me Bro Then Websites Went Offline (The php2shell story) | Threat Wire

MediaVideo
Yanac

How did one mysterious Hacker News post saying “Trust me bro” trigger a global cybersecurity panic and send major websites offline? In this episode of Threat Wire, we break down the PHP2Shell vulnerabilities, the race to uncover remote code execution (RCE) exploits, fake proof-of-concept attacks, and the emergency security patches that followed. From millions of vulnerable internet services to leaked exploits and a controversial disclosure by Chainguard, discover how one warning sent the cybersecurity community into chaos.

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire

LINKS
https://x.com/h4x0r_dz/status/2112620404309184734
https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/
https://pokemongohub.net/post/news/multiple-pokemon-apps-taken-offline-after-php-cyber-attack/
https://x.com/lanze_codes/status/2112998909840609338?a=km40n_RgLOtpEqS2pq8&s=20
https://x.com/mikko/status/2112934524480885103
https://x.com/takaichi_sanae/status/2112890642590564386
https://www.tomshardware.com/tech-industry/cyber-security/devastated-forum-user-who-accidentally-broke-the-php-news-embargo-comes-clean-user-says-they-were-unaware-of-disclosure-restrictions-move-clearly-backfired-in-a-pretty-wild-fashion
https://calif.io/php2shell/
https://www.wiz.io/blog/php2shell-php-rce
https://www.vulncheck.com/blog/php2shell-vulnerabilities
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
https://x.com/SinSinology/status/2113001596518862936
https://php2shell.censys.com/
https://www.php.net/eol.php
https://www.tenable.com/blog/cve-2025-1974-frequently-asked-questions-about-ingressnightmare-kubernetes
https://www.php.net/archive/2026.php#2026-10-23-1
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
https://socprime.com/blog/cve-2026-115560-new-unpatched-php-rce-risk-requires-immediate-mitigation/
https://x.com/TheHackersNews/status/2113592819730546935
https://www.linkedin.com/posts/marijnmarkus_security-expert-i-didnt-know-php-existed-activity-7519382991178170368-BSp4
—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5’s mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.Hak5Read More