Security advisory: Critical remote code execution vulnerabilities, update now

The exploit demonstrated on a personal site dumped the whole database and gave the attacker a server shell, all from a single URL payload. The proof‑of‑concept video circulated on Twitter shows the exact command string that triggers the breach. The author shut down all his sites after confirming the dump, calling the bug "catastrophic". No official patch exists yet; the small release team is still asleep. This makes the vulnerability the most severe PHP flaw seen in recent years.

The attack works by injecting malicious code into the request line, which the PHP interpreter executes without sanitization, opening a reverse shell. The video confirms that pasting the payload into the address bar is enough to compromise the host. The exploit was leaked shortly after a video of the flaw went public, accelerating its spread. Because the code runs before any application‑level checks, any LAMP stack with default settings is vulnerable. The rapid sharing of the proof‑of‑concept suggests many automated agents could weaponize it within hours.

The release delay is due to a tiny team responsible for the security update, all of whom are currently unavailable. The source notes that the maintainers are still asleep, explaining why no patch has been issued despite the public exploit. This gap leaves millions of cheap or unmaintained LAMP installations exposed. The community expects VPS providers to intervene, but no coordinated mitigation is in place yet. The situation illustrates how a single unpatched zero‑day can become a widescale crisis when the responsible team cannot respond quickly.

If you run any PHP site, shut it down immediately until a patch is available, or block the vulnerable request path at the firewall. Verify that your server does not accept arbitrary URL parameters that could be executed. Consider moving critical workloads to hosts that can apply emergency mitigations, and audit all LAMP instances for similar unsanitized entry points. Keep an eye on official PHP security channels for the upcoming release, and plan a rapid rollout once it lands.

TakeawayTurn off or isolate vulnerable PHP servers now; the exploit can steal databases and give full shell access with a single URL.