Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now
Video: Alex Kantrowitz on YouTube
- PHP's 21 October advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution, and urges all PHP users to update immediately.
- Stamos said "we now have evidence that bad guys started exploiting this well before the public release" and gave no source for that evidence (02:25).
- Stamos described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites" (06:35); it is his own estimate, with no measurement.
The Big Technology Podcast episode, uploaded to YouTube on 23 October 2026, is titled "The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos". The video's description names Stamos as the chief information security officer at Cognition. The PHP project's own advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Stamos said the bug is "a big deal because it is a pre-authentication remote code execution". He said "we now have evidence that bad guys started exploiting this well before the public release". He said the patch covers only the latest family of PHP, so sites on older versions face upgrades that can break them. He described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites". On AI, he said attackers are in some cases using it to run attacks, and that he has no good statistics on how widespread that is; he named no model. He also said the bug was found through a programme run by OpenAI, which the captions render as "Hack the Planet". Stamos said he runs an abliterated version of GLM-5.3 on a Mac Studio for exploit work, and described the open-weight models as a route by which these bugs would have been found anyway.
What it means for you Our view
If your servers run PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today: the PHP project says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Stamos's account of earlier exploitation and of attacks on tens of millions of sites is his own and unmeasured, so it is a reason for speed, not a count. He also says upgrading older PHP versions can break sites. If you cannot update straight away, ask your host or vendor today which fixed release it will run and when, and test the upgrade on a copy first.