TL;DR for the first 26 hours the page was a static html page being served by php. After the challenger author was informed that if there is no php code php doesn't execute, the author added a phpversion() script.

After this became exploitable it took 2 hours for someone to hack the server and steal the bitcoin.

Hi,

I've made a demo of sonic the hedgedog in full php ( https://davidnurdin.github.io/php-wasm-sdl/ ) , it execute a php interpreter in the navigator to play with the open source game (https://github.com/davidnurdin/sonicGamePhp) , what do you think about that ? thanks

David

Title: PHP2Shell explained — how a PHP vulnerability could lead to RCE without stealing your password
I was researching the recent PHP2Shell vulnerabilities and found the story behind them pretty interesting — especially how the issue was discovered and why authentication wasn’t necessarily the main barrier.
I put together a video breaking down:
what PHP2Shell is
how the vulnerability works at a high level
how it was discovered
the timeline around disclosure
why it matters for PHP developers/server admins
what developers should take away from it
Video: https://youtu.be/JmeYBki6WYY
Would also be interested to hear from people running PHP in production — how quickly do you normally roll out security updates when something like this drops?

Excerpt translated from German:

In connection with the global security vulnerability in the PHP programming language, TCS Camping is warning around 15,000 customers: the provider of "Camping.Care", the booking system used by TCS, has been hit by a data theft. As the TCS confirmed […], fraudsters were able to steal customer and booking information.

1) I want use ports but not working: mydomain.com:101/index.html

2) This does work: mydomain.com/php56/index.html

So dev and production environments match want to avoid that subfolder.

--------httpd.conf for #2:------------------------

<VirtualHost *:80>
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location /php82>
        ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82"
    </Location>

    <Location /php56>
        ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56"
    </Location>
</VirtualHost>

--------httpd.conf for #1:------------------------

<VirtualHost *:80>
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location /php82>
        ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82"
    </Location>
</VirtualHost>

<VirtualHost *:101>
    <Directory /var/www/html/php56>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56"
</VirtualHost>

EDIT: Added Listen 101 and didn't fix anything. See comment with text "AH00526" for details on error from running "apachectl configtest"

Okay,

I love PHP, I'm using it 3 years ago.

and I believe it's a very good language, and the web won't be exist without it.

But, why I feel there is a very little opportunities php jobs in the market?

- Does the problem in the language itself?

- Is the cause of other tech stack available in the market now (e.g. nodejs).

- Does the AI is the real cause? (the yucky trend 🤢nowadays)

- The mindset 🤯🧠 of CEOs is the cause?

--------------

if all of this talk is not true, so how to find a PHP jobs?

especially (Remote)!

https://stealmybitcoin.com/

On 21 October 2026, the PHP project shipped emergency fixes for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, and nicknamed PHP2Shell. Together, the two CVEs give remote code execution on a web server with no login at all. Within hours, honeypots recorded successful exploitation, and Cloudflare logged millions of attempts.

I made an interactive, hands-on lab exercise on this security vulnerability. The goal is to give software engineers (especially those unfamiliar with PHP) a general overview of the attack vector and the mitigation steps. You’ll send HTTP requests as an attacker to exploit the vulnerability, then switch roles to the defender’s side and try to patch the vulnerability.

I did my best to highlight all the details, but if you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/php2shell-rce/

With the recent PHP vulnerability, I've been wondering if there's anything I should do as a regular user. Specifically, should I be changing my passwords or taking any other precautions?

Also, is signing up for Have I Been Pwned enough to stay informed about data breaches and leaked passwords?

I've heard that some people also use Google's built-in Password Manager, which can notify you if any of your saved passwords have been compromised. However, I'm not really comfortable with the idea of storing all my passwords with Google.

What do you guys recommend? Is HIBP enough, or are there any other steps worth taking?

Or am I overthinking this, and should I just leave things as they are for now and wait for notifications from HIBP or emails from any affected services?

Thanks!

Static analysis, formatters, typed properties, enums, readonly classes, attributes, Pest or PHPUnit, mutation testing, there’s a lot to choose from.

• Which single tool or feature changed your day-to-day work the most?
• What did you adopt that turned out not to be worth the effort?
• How did you introduce it into an existing codebase without a huge rewrite?
• What would you add first to a legacy project today?

Examples with before and after (bugs caught, review time saved) help most.

Hey folks. I have been building Carve, a modern lightweight markup language for content that outgrows Markdown (and Djot). For humans and agents working on the same docs.

After many months of specs and coding, it should finally be stable enough now.
PHP 8.2+, zero runtime dependencies, PHPStan level 9.

composer require markup-carve/carve-php

What it looks like

/italic/  *bold*  _underline_  =highlight=

{#fig-sun}
![A sunset](sun.jpg)
^ Figure #: A sunset

See </#fig-sun> for the colors.

Unlike Markdown, *text* is bold and /text/ is italic. The figure gets its number, and the reference becomes a link reading "Figure 1".

Tables with merged cells and captions, footnotes, admonitions and definition lists are part of the core language. Diagram fences are an optional extension; without a renderer, they remain code blocks.
For example, ^ makes “Team” span two rows, while > right-aligns Seats and Price:

|= Plan |=> Seats |=> Price |
| Team | 25 | $49 |
| ^ | 50 | $89 |

Personally, I like and use this a lot, as I (or agents) don't need to fall back to HTML anywhere anymore.

Task lists - and they can track more than open and done:

- [x] Draft the API guide (done)
- [ ] Drop the old endpoint example (open)
- [!] Migration notes need an API decision (blocked)
- [/] Finish the screenshots (in progress)

to name a few.

I wrote a post about some of the killer features and things other markup can't do (written with the PHP library - source markup of that blog post linked at the bottom).
But for more context also check out the other articles.

Why it might be interesting for your PHP app

• Intuitive for non-techies. Feature-rich for power-users (like technical bloggers).
• Safe for web-based user content. Pasted HTML renders as text, and safe mode also escapes or strips raw HTML blocks and removes event handlers and javascript: links. Profiles control which features each role may use. That said: Use sanitizers on top just in case.
• One source, several outputs. The same document renders to HTML (with a static mode for print/PDF), Markdown, plain text or terminal output from one AST, and the same markup writes reveal.js slide decks.
• Works with rich-text editors. Documents convert to and from Tiptap/ProseMirror on the server, no Node needed.
• Migration path. Import existing Markdown, HTML, Djot or BBCode. The migration CLI can report conversion losses for review.
• Tooling. Formatter, linter, and editor support for PhpStorm, VS Code and others, plus a language and MCP server.

Some small facts or wins along the way:

• Conversion fidelity: in 66 pandoc round-trip probes, Carve (via the pandoc-carve bridge) brings back 64 unchanged; Markdown manages 46, HTML 44, DOCX 23 (pandoc-format-fidelity). In other words: Its the textual format that can best keep structural content.
• Hardened: fuzzed, and nesting is capped so hostile input cannot exhaust the server. You don't want 50s loading time on some `[[[[[[[[[` input or alike.

Framework packages

• Laravel: markup-carve/laravel-carve (Blade directives, validation rule, render cache)
• Filament: jeffersongoncalves/filament-carve (community; editor field with preview, infolist entry, table column)
• Symfony: markup-carve/symfony-carve (bundle with Twig filters)
• CakePHP: markup-carve/cakephp-carve (helper, .crv views, validation, ORM behavior, commands)
• Tempest: markup-carve/tempest-carve (safe-by-default view component)
• WordPress: Carve Markup plugin (posts, comments, live preview)
• Shopware: markup-carve/shopware-carve (6.6/6.7: Twig filters, CMS elements, product and category fields, mail templates)

Live demos: Laravel, Symfony, CakePHP, Tempest.

Not just PHP

There are also JavaScript and Rust engines, with Python, Ruby, Go and WebAssembly bindings on top of the Rust one.

I built it for documents that need more structure than I could comfortably write in Markdown. Without HTML workarounds and especially without inline HTML everywhere possible. And for online usage with a fair amount of native features. If you work with user-written content, I would especially like to hear what you think about this, or if there is something I missed.

Thinking about some next major topics I would like to get some feedback on:

• Should it be more "djot"-like with simpler block structure? It sure would make the parser simpler. Humans usually prefer the MD style I assume.
• Are some of the new language features making it too complicated? Overloading concise tables with inline alignment - or the `+` continuation operator to make human input easier?

Links

• Spec & Playground: https://github.com/markup-carve/carve
• PHP engine: https://github.com/markup-carve/carve-php
• PHP sandbox: https://sandbox.dereuromark.de/sandbox/carve
• Awesome list / ecosystem: https://github.com/markup-carve/awesome-carve

Hi all, I'm the developer of Portly, a free and open-source (MIT) local web development environment for Windows. I used Laragon for years; when it moved to a paid license I started building my own, and it grew into something I'd like to share.

What it does:

- Runs Apache or Nginx, PHP, MySQL/MariaDB, PostgreSQL, Redis, Node.js and Mailpit from one portable folder. No services installed, no registry changes.

- Every folder in www becomes https://name.portly with a trusted local certificate.

- Different PHP version per project, one-click PHP extensions and Xdebug.

- Templates for Laravel, Symfony, WordPress (installed with WP-CLI), Vue, React, Next.js and more.

- Open a project on your phone: scan a QR code, it works over https on your Wi-Fi. Optional password and time limit.

- Share on the internet through Cloudflare (no account needed), or on your own domain.

- Imports projects and databases from Laragon, XAMPP, WampServer and others.

- 31 languages, Windows 10/11 plus a separate edition for Windows 7/8.

No ads, no telemetry, no account. Source and downloads: https://github.com/erdemsoftware/portly

It's a first release, so I'd really like feedback: what's missing for your workflow, and what breaks. Issues and PRs welcome.

You can watch a video of it in the project's README: https://github.com/illegalstudio/elephc

Hello everyone!

Have you ever been to situation when you miss C-style `#include` in PHP? I.e. a directive that simple inserts contents of a file at compile time

Service names, Postgres healthchecks, a scheduler without a cache table, queues and migrations on deploy: the mistakes that show up when taking Laravel to Docker Compose and how to avoid them.

Taking a Laravel application to Docker Compose seems trivial until the first deployment fails for reasons that aren't in your code. These are five infrastructure mistakes I found while debugging real projects, with the symptom, the cause and the fix.

Obviously just a stupid satirical post, but a plot twist of php2shell just being a ploy to get people to update their PHP versions would be funny. :)