27 stories tagged php, newest first.
98 points by firesteelrain | 56 comments
Reuters article reporting that the PHP Foundation is under-funded with only one full-time staff member, according to its director; page showed a device verification screen.
169 points by drewsberry | 203 comments
Blog post surveying a week of critical software vulnerabilities, including PHP2Shell RCEs found with AI, and discussing whether LLM-driven exploitation is the new normal.
227 points by cubefox | 98 comments
AWS Security Blog post reporting that Amazon's MadPot honeypots saw PHP2Shell exploitation attempts four days before public disclosure, with IOCs and recommended actions.
683 points by petecooper | 244 comments
A Tell HN post in which a user apologizes for unknowingly breaking the coordinated disclosure embargo on two PHP remote code execution CVEs, followed by community discussion.
566 points by zkldi | 437 comments
Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.
110 points by hayd | 26 comments
GitHub issue requesting Amazon Linux 2023 ship patched PHP packages for critical CVEs, with users asking AWS for a release timeline.
50 points by mpaepper | 17 comments
A Mastodon thread by security researcher Elise describing a newly found PHP double-free vulnerability affecting 8.4 and 8.5, reported to [email protected] with details withheld.
761 points by ejohnso49 | 394 comments
PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.
78 points by Maxious | 7 comments
Cloudflare blog post announcing new WAF managed rules protecting against the php2shell PHP vulnerability and advising users to update PHP.
253 points by nr378 | 183 comments
OpenAI post describing its Patch the Planet initiative coordinating disclosure and fixes for critical PHP vulnerabilities found with AI models, and proposing a response framework.
26 points by nr378 | 5 comments
PHP2Shell, a website for a tool that appears to provide an interactive shell for PHP; no page content was captured.
239 points by timvdalen | 82 comments
PHP.net homepage announcing the releases of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
1036 points by tuyuri | 562 comments
GitHub release page for PHP 8.2.35, a security release fixing two critical unauthenticated remote code execution vulnerabilities; PHP 8.2 reaches end of life December 2026.
398 points by danlark1 | 184 comments
Wiz Research blog post detailing PHP2Shell, critical memory-safety and pre-auth RCE vulnerabilities in the core PHP engine found with help of frontier AI models.
240 points by jacquesm | 94 comments
Notice from the Dutch National Cyber Security Centre that its website is temporarily offline as a precaution due to PHP vulnerabilities, with a patch expected at 16:00.
1438 points by xd | 658 comments
PHP announce mailing list post warning of an upcoming security release on 21 October 2026 fixing two critical vulnerabilities rated CVSS 9.2.
137 points by mnapoli | 126 comments
Landing page for /dev/null, a GitHub-login social network for developers to follow coders and post plain text to a shared log, built live in PHP.
31 points by edris0077 | 7 comments
GitHub repository for Edi Life OS, a self-hosted PHP life dashboard for habits, goals, Kanban, finance and focus with an MCP server for AI assistants.
226 points by vntok | 124 comments
GitHub security advisory for a critical WordPress unauthenticated path traversal in page-template resolution leading to conditional RCE, listing affected and patched versions.
325 points by jakeasmith | 96 comments
Blog post by Jake A. Smith about deprecating his 2014 PHP shim for http_build_url(), written for AOL's CMS, which reached nearly 20 million Packagist installs.
444 points by Mojah | 544 comments
Mattias Geniar's blog post reflecting on how web development felt simpler in the PHP 4 and jQuery era and arguing it has become fun again.
403 points by lemper | 253 comments
PHP Foundation blog post by Larry Garfield explaining the pipe operator (|>) coming in PHP 8.5 and how it passes values to callables.
452 points by theThree | 299 comments
Official PHP 8.4 release announcement page describing new features like property hooks, asymmetric visibility, an updated DOM API, and performance improvements.
856 points by chrisdemarco | 224 comments
Blog post describing a PHP project that prints a custom daily news front page on a dot matrix printer bought from eBay.
383 points by aquova | 179 comments
Homepage of FrankenPHP, a modern PHP application server written in Go.
431 points by disadvantage | 181 comments
Landing page for WordPress Playground, a tool that runs a full WordPress instance entirely in the web browser for trying blocks, themes, and plugins.
422 points by eiiot | 419 comments
A promotional site titled "Go with PHP" that advocates using PHP, showing Laravel-style request validation and authorization code as an example.