Top stories

A newly disclosed PHP vulnerability has prompted thousands of purported proof-of-concept exploits, but security researcher Elias Taylor says none he examined worked against an unmodified, vulnerable PHP installation. Writing about the issue on October 21, 2026, Taylor said many circulating demonstrations either are nonfunctional, work only in laboratory conditions, or modify the target server in ways that introduce a separate weakness. Taylor said many of the claimed exploit chains depend on local file inclusion (LFI), requiring a server to read and execute a user-selected file. He argued that this prerequisite amounts to relying on an existing server-side vulnerability and therefore does not demonstrate easy compromise of arbitrary PHP instances. Taylor contrasted the situation with vulnerabilities such as Log4Shell, Heartbleed, Shellshock, and Ruby on Rails YAML deserialization, which enabled straightforward attack payloads and quickly drew botnet activity. He attributed the volume of flawed proofs of concept partly to developers relying on large language models to infer exploit chains from a patch diff, saying LLMs can reproduce the same incorrect assumptions across independent-looking projects. A PHP core team member had reportedly warned that exploits could emerge within 15 minutes of a patch release, but Taylor said no broadly working exploit had appeared about 10 hours after disclosure.