Bitcoin Magazine
Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path
Bitcoin Core just changed its security policy because AI can find bugs with a simple prompt. Jameson Lopp explains the bigger trend behind it: two and a half months of exponential growth in vulnerability discovery, attackers adopting uncensored AI models first, and security researchers who “have not been able to get a lot of rest.” He breaks down the PHP remote code execution flaw, why the fallout was smaller than expected, and why security now has to be real time and built into the development pipeline instead of a once-a-year audit.
Chapters:
0:00 Bitcoin Core Changes Its Security Policy: AI Finds Bugs With a Simple Prompt
1:04 Google’s 500,000-Qubit Estimate: Physical vs. Logical Qubits
2:00 The Quantum Timeline: “If We Have Less Than a Decade, We’re Behind”
2:57 Why We Don’t Have a Quantum Computer With More Than a Few Hundred Usable Qubits
4:26 30% of Addresses Have Exposed Keys: Who Attackers Would Target First
6:27 Why a Quantum Upgrade Will Take Years: Taproot, Consensus and Untested Cryptography
7:54 The PHP Remote Code Execution Flaw Explained
9:41 The Real Trend: Exponential AI Vulnerability Discovery and Exhausted Defenders
10:54 Security Must Be Real Time: From Annual Audits to the Development Pipeline
13:19 Hardware That Can’t Be Patched, and Why Wrench Attacks Have Topped 700
DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.
This post Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path first appeared on Bitcoin Magazine and is written by Patrick Green.
Bitcoin Magazine
PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic”
Government websites in France and Finland and hospital sites in the Netherlands are offline, Cloudflare is seeing attack traffic, and Britain’s National Cyber Security Centre is telling organizations to pull systems if they can’t patch fast. Bitcoin Magazine technical editor Shinobi joins Grace Remington and Sean Hagan to explain what broke in PHP, why memory management mistakes are the most common security flaw, and why AI finding the exploit in hours changes the pace of hacking but not its nature. He also answers the question every Bitcoiner is asking: is Bitcoin exposed?
Chapters:
0:00 The PHP Exploit Takes Government and Hospital Websites Offline
0:54 AI Found the Flaw in Hours: The “Cyber Pandemic” Warning
1:45 What Actually Broke: Memory Management Mistakes Explained
3:06 Why PHP Was Never Secure and Why This One Is Different in Scale
3:47 Is the AI Hacking Story Sensationalized? AI Does 95% of the Work
5:08 The Rough Adjustment Period and Why Shinobi Is Confident About the Other Side
6:41 No Serious Software Will Ship Without an AI Security Audit
7:23 Is Bitcoin Exposed? libsecp256k1, Bitcoin Core and Why Slow Development Was Right
9:30 Take Your Lightning Node Offline and Keep Your Coins in Cold Storage
12:09 Multisig and Sparrow Setup Checks, and Where to Follow Security Engineers
DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.
This post PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic” first appeared on Bitcoin Magazine and is written by Patrick Green.
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.
The post PHP2Shell Exploitation Moves From Probes to Working Shells appeared first on SecurityWeek.
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server. The researcher, using the GitHub username KillaBoi, published the exploit in […]
The post Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.
TL;DR: PHP released fixes for two critical flaws on October 21 and urged immediate updates. Crypto businesses using PHP-based web infrastructure should check that layer of their systems; the advisory does not announce a breach of Bitcoin or BTCPay Server itself.
Security work for a crypto business does not end at its wallet. A critical PHP update has put ordinary web-server software back on the operational agenda.
The PHP project’s October 21 advisory identifies two vulnerabilities that can allow unauthenticated remote code execution. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project strongly encourages affected users to update immediately.
It says installations serving web requests are at risk and highlights the Apache mod_php configuration as particularly exposed. Distribution vendors may provide patched packages, so the applicable fix depends on how the software is supplied and maintained.
The connection to crypto commerce is practical. BTCPay Server’s official documentation explains how merchants can connect its payment system to WooCommerce, including arrangements involving an existing store or a deployed store environment.
A merchant using that combination has several components to maintain. The checkout website, its plugins, the hosting environment and the payment service have distinct responsibilities. Updating one component does not establish that every other part of the stack has been patched.
The PHP advisory is about the runtime handling web requests. It is not evidence that Bitcoin’s protocol has been compromised, and it does not by itself identify a flaw in BTCPay Server’s core software.
It does provide a reason for administrators and hosting providers to check whether any connected storefront or service uses an affected PHP installation. The relevant confirmation is that the running environment contains the fix, rather than simply that an application plugin was updated.
The PHP team’s guidance is the authoritative starting point for remediation and version-specific details. Unsupported installations need particular attention to vendor support or migration to a maintained release.
No claim about stolen customer funds or a specific crypto company’s compromise is established by the advisory. The immediate news is the release of critical fixes for infrastructure that can sit underneath a crypto payment experience.
This article was written by the News Desk and edited by Samuel Rae.
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems.
The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public.
Amazon added the flaws were “now being broadly exploited in the wild.”
© Getty Images
Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide.
Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber Security Centre (NCSC) urged organisations to identify affected systems and apply updates immediately, while Amazon’s threat intelligence team reported evidence of exploitation attempts dating back to 17 October.
With the vulnerabilities highlighting the potential consequences of security flaws in widely used web infrastructure, The IT Security Guru has gathered reactions from cybersecurity industry experts on the risks, implications and lessons for organisations.
“Taking a website offline for a day is a far cheaper decision than explaining a breach for a year. The agencies asking organisations to do exactly that are giving sound advice, and the speed of the coordinated response shows how much the discipline has matured. These flaws sat in code that dates back to 2004 and were found with AI. The same tools will help attackers move just as fast, and early attacks are already being reported. The job is simple to state and hard to do. Find every system running PHP, including the ones hidden inside third-party products. Update to a supported version or take it offline. Then check that nothing got in while the window was open. Patching is the easy part. Knowing what you run is the real test.”
“PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason. With Log4j, the main problem was finding a library you didn’t know you had. With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix.
“The durable lesson from Log4j is that organisations should treat “How quickly can we identify where we run X” as a measurable capability separate from patching speed.
“Discovering vulnerable infrastructure, however, is only the first step. When older systems have no available fix or depend on a vendor update, organisations need to reduce exposure, restrict unnecessary connections, and isolate affected systems while planning remediation.
“AI is very good at performing variant analysis when it has a reference point, lowering the effort and expertise required. That could increase the volume of attempts we see with these critical vulnerabilities, even if many never turn into full exploits.
“Common places where forgotten PHP tends to live include:
“Organisations concerned about exposure should prioritise identifying affected systems, reducing unnecessary external exposure, and follow vendor guidance for remediation or compensating controls. Teams should use a combination of external exposure scanning, host-level package managers, container or SBOM scans and network behavior to identify all implementations of PHP in their environment. Organisations who believe they are compromised should rotate secrets on exposed hosts, filter multipart at the edge, restrict agree from web workers, isolate EOL hosts. Look for classic web-shell patterns: php-fpm, httpd, or apache2 spawning sh, bash, curl, wget, or base64, new or modified .php files in web roots and outbound connections from web worker processes.”
“PHP2Shell is a clear example of how little time we now have as defenders to secure our environments in the age of AI. In a world where these types of vulnerability discoveries may become commonplace, and details being leaked before formal disclosure, exploits created exceptionally fast, and attackers exploiting the issue in the wild rapidly before fixes are even available. It’s almost impossible to justify a traditional maintenance window in this situation and what can you do if you know for a fact you’re vulnerable and you need to decide if you even can apply a temporary mitigation, or need take exposed systems offline. Its a nightmare scenario for security teams.
AI may play a part in making this worse as it helps attackers develop exploits faster, but its also what gives us the power to discover these issues so they can finally be fixed. So the challenge is now to arrive at a balance where we have the capability to not only identify exposed systems, but also develop effective mitigations and get them deployed before active exploitation can cause these types of disruptions.”
“The scale of this is enormous. We’re talking about two serious security flaws in technology that underpins around three-quarters of the internet, potentially allowing criminals to access vulnerable systems remotely without even needing a password. We’ve become so dependent on digital services that we rarely stop to consider how much of our everyday lives relies on the same underlying technology. Governments, businesses, banks and public services are all connected through an increasingly complex web of systems, and when a weakness like this is discovered, huge numbers of organisations can find themselves exposed at once. It’s a bit like discovering that millions of buildings have been fitted with the same faulty lock. Suddenly, everyone is racing to change it before someone works out how to open the door.
We’ve already seen how disruption involving major technology providers can have consequences across the world, and there are growing questions about our reliance on a handful of companies to keep essential services running. Regulators are now looking much more closely at the role these providers play in our critical infrastructure. The timing is particularly concerning given the NCSC’s warnings that artificial intelligence will increase the frequency and intensity of cyberattacks. Criminals are becoming faster at identifying weaknesses and exploiting them, leaving organisations with less time to respond.
When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken. The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time.”
“This is a genuine drop-everything moment for anyone running PHP. The flaws are in the PHP engine itself, so a perfectly secure application on top of a vulnerable runtime is still exposed. Updating WordPress or your framework won’t fix it. You have to update PHP itself and restart the services that run it. It’s understandable that people are confused about how this unfolded. Word of the vulnerabilities leaked on Y Combinator’s Hacker News forum two days before the planned disclosure, and PHP moved its security release up a day in response. The source of the leak hasn’t been identified, but there’s no evidence a threat group was involved, and no exploit code was released. A screenshot of the researchers’ exploit tool did circulate, which added to the alarm. In the end, the early reports were largely accurate. The main difference is severity: PHP officially rates both flaws 9.2 rather than the 10.0 some reports cited. That’s still critical, and it doesn’t change the advice. The organizations I’m most concerned about are the ones that don’t know where PHP is running in their environment. Older versions sitting in containers, appliances, or legacy sites won’t receive an official fix. Nobody wants to be building a software inventory in the middle of an emergency. You need that visibility before the next one hits.”
“Preventing leaks of any vulnerability data for a CVE prior to an embargo for the patch being published is precisely what coordinated vulnerability disclosure processes are designed to protect against. When a leak, or advance knowledge, of a vulnerability occurs the entire ecosystem surrounding the vulnerability is placed at risk. As details of the leak are published, security defenders are faced with the real risk that malicious actors could use the absence of an official patch to supply their own malicious patches. Defenders should pay extra attention to the origin of their patches and validate functional changes against official release notes. After all, a malicious patch could implant a backdoor for future use and a rush to patch might present the right opportunity for malicious actors.”
“The NCSC advises identifying PHP across your infrastructure, prioritising internet-facing systems, and not limiting the search to outdated versions. That includes appliances and services that bundle PHP, so keep monitoring for updates from third-party vendors.
Update to the latest version of PHP and apply the additional hardening steps from the PHP Team. If you cannot update, the PHP Team has provided temporary mitigations. If those cannot be applied, or would take too long, the NCSC suggests considering taking the system offline until it can be fully mitigated.”
The PHP2Shell vulnerabilities serve as a reminder of how quickly weaknesses in widely used software can become a global cybersecurity concern. As organisations work to secure affected systems, the incident reinforces the importance of timely patching, continuous monitoring and maintaining visibility across the software powering critical services.
“The two critical flaws found in PHP, the programming language behind WordPress and countless online shops, have now led to government services in France, Denmark, Finland and the Netherlands going offline, alongside UK council sites, NHS Scotland and Wikipedia. Fixes arrived on Wednesday amid reports of millions of attempts to exploit the flaws, though it remains unclear whether any have succeeded. CERT-EU, the EU’s cybersecurity response team, had advised organisations that could not patch immediately to consider isolating their internet-facing applications.
The scale sets this apart from a routine patch cycle. PHP sits beneath sites run by multinationals, public bodies and one-person businesses alike, and most of the people running them are not security specialists. They rely on hosting providers, plugins and agencies to keep up, and many are learning about PHP for the first time this week.
The flaws sat in widely used code for years until AI tools surfaced them. OpenAI, whose model helped find them, expects similar findings to increase sharply in the coming months, as AI continues to lower the effort needed to turn a complex flaw into a working attack. Patching is only the first step, and any site exposed before it was fixed should review who has access to both the site, as well as internal systems within an organisation. Security teams should remove admin accounts that are no longer in use, implement the principle of least privilege to restrict access, replace passwords as a precaution and protect every login with multi-factor authentication.”
The post Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React appeared first on IT Security Guru.
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.
The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.
Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.
The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.
Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.
The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.
Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.
The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.
Login
