SecurityPHP flaw 'PHP2Shell' stirs a scramble: Coding Apple video at 250,000 views, top comment jokes about hackers who "patched it quietly and left"

A critical flaw in PHP, one of the most widely used server languages, is trending on YouTube too. A Korean channel, Coding Apple (464,000 subscribers), posted a video Oct. 28 saying sites worldwide paused operations to patch, and it reached about 250,000 views in under a day. It also discusses how AI is changing the response to security threats.

Security outlets confirm the background. Per BleepingComputer and SC World, the PHP project shipped emergency patches Oct. 21 for two remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619), a day ahead of schedule after details leaked on a developer forum. CISA advised patching immediately. Fixed versions were reported as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some outlets say AI helped find the flaws, and reports differ on whether attacks began before the patch.

Comments leaned on humor. The top one (939 likes) joked about intruders who got in through the flaw, quietly patched it and vanished. Another (138) said PHP's old-timer image made the scale of its use a surprise.