Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now

The Big Technology Podcast episode, uploaded to YouTube on 23 October 2026, is titled "The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos".

Watch page: title "The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos"; uploadDate 2026-10-23T13:39:22-07:00.

The video's description on its watch page states: "Alex Stamos is the Chief Information Security Officer at Cognition."

Watch page description: "Alex Stamos is the Chief Information Security Officer at Cognition."

Stamos said: "the bug is a big deal because it is a pre-authentication remote code execution" (02:46).

02:46 "Anyway, the bug is a big deal because it / is a pre-authentication remote code / execution."

Stamos said: "it started to leak out and we now have evidence that bad guys started exploiting this well before the public release" (02:25). He gave no source for the evidence in the interview.

02:25 "it started to leak out and we now have" 02:27 "evidence that bad guys started" 02:29 "exploiting this" 02:30 "well before the public release."

Stamos said: "They only released a patch for the latest family of PHP and there's a lot of PHP sites on older versions and so upgrading that breaks your site" (03:39). This is his account; the PHP project's own advisory lists fixed releases for four lines, 8.2 to 8.5 (claim 2816).

03:39 "They only released a patch for the / latest family of PHP and there's a lot / of PHP sites on older versions and so / upgrading that breaks your site."

Stamos described the attacks now under way as "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites" (06:35). This is his own estimate; he gave no measurement.

06:35 "dozens or hundreds of hackers of hacking" 06:38 "groups attacking tens of millions of" 06:41 "websites"

On AI in the attacks, Stamos said "I don't have any good statistics on where we are, but in some cases they are also using AI to do the attack" (08:09). He named no model or product.

08:07 "...I I I don't know I" 08:09 "don't have any good statistics on where" 08:11 "we are, but in some cases they are also" 08:12 "using AI to do the attack"

Stamos said the bug was found in "a project that was being run by OpenAI called Hack the Planet" (01:11), as the captions give it, and that a security consultancy the captions give as "Kalif" "used it to find the PHP bug" (01:55 to 02:04). He did not name a model.

01:09 "in a uh" 01:11 "a project that was being run by OpenAI" 01:14 "called Hack the Planet..." 01:55 "A a called Kalif, which is a kind of" 01:57 "excellent security consultancy" ... 02:01 "research. They used it to find the PHP" 02:04 "bug."

Stamos said: "I'm running a obliterated uh quantized version of GLM 53" (24:16), the automatic captions' rendering of an abliterated, quantized version of GLM-5.3, run on a Mac Studio he said he had just received.

24:16 "...So I've got my M5 Studio Max finally came. I'm" 24:19 "running a obliterated uh" 24:21 "quantized version of GLM 53"

Stamos said of that setup: "the exploits I can write, the things I can do now on a Mac Studio that leaves absolutely no logs" (24:28).

24:28 "I can do, the exploits I can write, the" 24:30 "things I can do now on a Mac Studio that" 24:32 "leaves absolutely no logs."

Stamos said of the PHP disclosure: "This was handled as well as it possibly could be. It was always going to be bad." (24:07).

24:07 "widely distributed. This was handled as" 24:10 "well as it possibly could be. It was" 24:11 "always going to be bad."

Stamos said: "this is probably the new normal for several years" (14:35), speaking of the pace of security events in the past 30 days.

14:35 "think unfortunately, this is probably" 14:37 "the new normal for several years, where" 14:39 "the pace of crazy things that have" 14:41 "happened in the last 30 days"

Stamos said: "these bugs were going to be found by the open weight models, the Chinese models" (24:32).

24:32 "...And so these" 24:34 "bugs were going to be found by the open" 24:37 "weight models, the Chinese models."

The PHP project's advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

21 Oct 2026 Security advisory: "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution."

The PHP project's 21 October advisory says the risk covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and says all PHP users are strongly encouraged to update immediately.

All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.