🚨 If anything you run touches PHP, stop scrolling. The FBI just issued a warning about 2 critical PHP bugs. They're being called PHP2Shell. Here's what you need to know in 60 seconds. What it is: → 2 bugs in the core of PHP itself → an attacker can run code on your server → no login needed → reportedly one single web request is enough Why it's scary: PHP powers a huge share of the web. WordPress. Laravel apps. Old client sites nobody has touched in years. Vendor products that quietly bundle PHP inside. And Amazon's threat team says it caught someone trying to exploit this 4 days BEFORE it was made public. What to do right now: 1. Update PHP Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 2. Find every place PHP runs Prioritize anything facing the internet first 3. Can't patch today? Take it offline until you can. That's the FBI's advice, not mine. 4. Watch your servers PHP launching command shells or downloading files is a red flag 5. Found something? Isolate the system, save your logs, and report it at http://ic3.gov The builder tip: If you have a pile of old projects, open Claude Code in each repo and ask: "Find every place this project uses PHP, list the version, and tell me what needs updating." The scariest part isn't the bug. It's the thousands of old sites that will never get patched. Don't let one of them be yours. Save this and send it to whoever runs your servers.