The Web Pulled Its Own Plug #1881
In this episode, Ray Cochrane returns to the studio in Michigan and leads with PHP2Shell. Those two PHP bugs, found with AI help, led sites from DeviantArt to government portals to go dark on purpose. Additionally, he covers OpenAI’s forward-deployed engineers, Anthropic’s Claude Frontier Academy, Apple’s American iPhone suppliers, Euclid’s first comet, and a new date for The Starry Night.
– Want to start a podcast? It’s easy to get started! Sign-up at Blubrry
– Thinking of buying a Starlink? Use my link to support the show.
Subscribe to the Newsletter.
Email Ray if you want to get in touch!
Like and Follow Geek News Central’s Facebook Page.
Full Summary
Ray Cochrane opens the show back in the studio, now that he has made it to Michigan. The drive from Oregon took about three days, starting on a Sunday and arriving Tuesday night. Along the way, the trip crossed Idaho, Wyoming, Nebraska, Iowa, Illinois, and Indiana before ending on Brocklebank Road.
Getting the studio running again was a nightmare. Just as he went to record the night before, nothing was coming in on the mic. So he spent the rest of that night, plus a few hours the next day, digging through wires until he finally got it figured out. A little feedback may still be on the line, but he feels blessed to be recording in the studio again.
Life in Michigan has been nice but a little weird. Cochrane usually stays only a short time, so part of his brain is still in leaving-soon mode. Meanwhile, video viewers get a new format, with a presenter mode that lets them follow along.
On the lead story, Cochrane’s team spent a few days upgrading servers to fix the PHP bug. Even so, the news came as a shock. Moreover, he expects many more bugs like it, since AI systems now hunt for flaws around the clock. He hopes this is the first of many cleanups of the major bugs in today’s systems.
PHP2Shell: The Bugs That Made the Web Pull Its Own Plug
The lead story comes from Ars Technica, which ran a Financial Times report on October 22. That week, a big slice of the web switched itself off on purpose. DeviantArt went dark for a while, and 4chan stopped taking new posts. Meanwhile, governments in Europe and Canada took sites offline until they could patch them.
The cause was a pair of security holes in PHP, the server-side language behind WordPress, Wikipedia, and Drupal. W3Techs data puts PHP on about 69 percent of sites where the language can be identified. Researchers nicknamed the bugs PHP2Shell. They allow remote code execution, so a stranger with no login can run commands on the server underneath.
Security firm Calif says it used the flaws to take over 11 web apps without logging in, including WordPress and MediaWiki. Wiz, another security firm, called the potential attack surface “enormous.” PHP rated both bugs 9.2 out of 10, which counts as critical. Still, an attacker needs a few conditions to line up first.
How the Bugs Work and Who Needs to Patch
Both bugs come down to memory, a classic programming headache. A PHP server reuses the same worker for request after request, and each request gets a memory cap. With the first bug, an attacker forces that cap to hit mid-job, and the cleanup then trusts something half-built. The second is a use-after-free bug: one request sets a trap, and the next one springs it.
Almost every way of running PHP was affected, and Apache’s mod_php on default settings was the worst case. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and servers need a restart after updating. Versions older than 8.2 get no new releases, only bare-bones source patches back to 7.4. As a result, Cochrane urges anyone still below 8.2 to upgrade, and CISA says to take anything unpatchable offline.
The flawed code dates back to 2012. According to the PHP Foundation, a contractor spotted the underlying memory problem in 2024, but the fix stalled. The Guardian reports the foundation has just 13 engineers, full- and part-time. It called the delay “a structural failure,” blaming its security team’s decision process and its lack of resources.
AI Found the Flaws, Then the Embargo Leaked
Then the AI tools showed up. Calif reported a working attack to PHP on August 11. According to OpenAI, Calif found one flaw using GPT-5.6 Sol through its Patch the Planet program with Trail of Bits. However, Calif’s own write-up names no model, crediting researcher Ryan Austin’s deep knowledge of PHP’s old bugs.
Wiz reported more variants on August 24, saying one researcher did in a week what once took a world-class team months. Google owns Wiz, and the firm credited Gemini 4 Argon with an invaluable contribution to the find. Cochrane sees a clear pattern here, and he expects it to continue.
The show has tracked this thread for months. Episodes 1862 and 1864 covered Anthropic’s Mythos finding a 27-year-old OpenBSD bug and 271 bugs Mozilla fixed in Firefox. Later, episode 1880 covered Gemini 4 Argon going to cyber defenders first.
At least four groups found the flaws on their own, including Chainguard, which says its own AI turned up the bug on October 16. Normally, finders report privately, trusted packagers get the fix early, and everyone goes public together. That promise to stay quiet until the agreed moment is called an embargo. PHP’s was set for October 22.
The embargo leaked on October 20, when the official bug IDs began circulating online. PHP pulled its release forward a day, Calif posted a demo video by mistake, and Chainguard shipped its own fixes early. Chainguard says attacks had already begun, while PHP says the early fixes broke the embargo. Cochrane calls the leak a pretty stupid mistake, especially with everyone waiting on a fix.
Attackers Got a Four-Day Head Start
Amazon runs decoy servers called honeypots to lure hackers. On October 17, four full days before the fix, one of them caught someone trying this attack. Amazon security chief CJ Moses wrote that “an embargo protects defenders only until someone else finds the same bug.” Additionally, the White House told Reuters it knew on October 16.
Government sites in France, Germany, the Netherlands, Canada and Japan came down as a precaution, though a number returned quickly. Mashable reports the group behind Wikipedia took some of its tools offline too. In the UK, the national cyber agency sent about 50,000 warnings. Meanwhile, Cloudflare CEO Matthew Prince reported thousands of exploit attempts across its network in the 10 hours before the announcement.
Palo Alto Networks’ Unit 42 says it saw a real break-in. Attackers reached a European government agency’s scrambled passwords and two-factor codes within two hours, using AI agents too. However, The Register counted no publicly confirmed break-ins as of October 23. Cochrane notes the sources go back and forth, but he still finds it crazy that attackers moved within days.
Millions of PHP Servers Still Exposed
Patching has been slow. Infrawatch estimated that only about 6 percent of visible PHP installs were patched by October 22. A day later, Censys counted more than 34 million PHP services still exposed. W3Techs also finds about a third of PHP sites on version 7 or older, where only 7.4 got even a source patch.
Much of the cleanup fell on one volunteer, Ondřej Surý, who builds the ready-to-install PHP packages many servers update from. He told The Atlantic he took in about a year’s worth of donations in a single day. In his words, this “has been a disaster waiting to happen for a really, really long time.” Then, on October 23, PHP flagged a third related flaw, though triggering it takes an unlikely mix of configuration and code.
CISA and the PHP team offer the same advice. Update to a fixed version now and restart the server. Amazon also recommends checking server logs back to October 17, the day its honeypot first caught an attempt. As Cochrane puts it, take their advice if you won’t take his.
Sponsor: GoDaddy
Economy hosting $6.99/month, WordPress hosting $12.99/month, domains $11.99. Website builder trial available. Use codes at geeknewscentral.com/godaddy to support the show.
OpenAI Explains Its Forward Deployed Engineers
The headlines start with OpenAI, where Colin Jarvis runs forward-deployed engineering. In an October 22 post, he explains the job. A forward deployed engineer, or FDE, works inside one customer’s company on its real problem, then brings the lessons back. Jarvis says FDEs close the deployment gap, since models can do more than companies trust them with day-to-day.
OpenAI’s own numbers include a cut of about 48 percent in test-writing time at one chip company. Meanwhile, Fortune reports FDE job postings jumped more than 1,000 percent, with median pay topping $188,000. Cochrane calls it a pretty cool concept and a helpful way to find gaps in models and harnesses. He also suggests programmers look into FDE work.
Anthropic Puts $100 Million Into Its Claude Frontier Academy
Anthropic has its own version of the same job. On October 2, it launched the Claude Frontier Academy with $100 million behind it. The goal is 10,000 trained frontier-deployed engineers before the end of 2027. It runs like a medical residency, with a multi-day build followed by a 12-week residency on a live Claude project.
The first groups started this fall in London, New York and San Francisco, with engineers from McKinsey, Deloitte and Morgan Stanley. However, Anthropic does not say what participants pay or how the money gets spent. The badge at the end is also Claude-specific.
Apple Names the American Suppliers Behind Its New iPhones
On October 20, Apple named the American companies supplying parts for the iPhone Duo and iPhone 18 Pro. The one new partner is Perryman Company, a family-run titanium maker outside Pittsburgh. Apple says it will spend up to $100 million with Perryman over three years. Perryman handles the Duo’s titanium from melt to rolled sheet, and Apple says at least 80 percent of it is recycled.
Returning partners include Broadcom in Colorado, Corning in Kentucky, and Coherent in Texas, which makes the lasers behind Face ID. Altogether, Apple counts close to 100 US-made parts from more than 12 states. It all falls under Apple’s $600 billion, four-year pledge to spend in the US. Still, every figure is Apple’s own, and it does not publish the full parts list or say where the phones are assembled.
Cochrane also notes a wave of negative reviews for the Duo, Apple’s first foldable. One test folded it 10,000 times, and the crease grows more visible with use. Many apps also still run at normal iPhone size inside black borders, so plenty of people are saying to pass on this one. He hopes Apple sorts it out in the next version.
DeepMind’s ForTy Maps the World’s Forest Types
Google DeepMind built ForTy, a free global map that sorts land into six types at 10-meter resolution. Most satellite maps stop at trees or no trees. However, from space, an old-growth rainforest can look just like an oil palm estate. Those two differ hugely in the carbon they store and the wildlife they support.
The map reflects 2020, the cutoff year in a European Union deforestation law covering coffee, cocoa and palm oil. DeepMind puts its accuracy near 90 percent, though the catch-all class props that up, and planted forest scores only about 58 percent. An early yearly version covering 2017 through 2025 shows what replaces forest after it is cut. Cochrane always finds DeepMind’s work impressive.
Expensive Gas Drives Britain’s Power Bill Jump
Carbon Brief’s Simon Evans covered a Nesta analysis of UK household bills from October 2020 to October 2026, adjusted for inflation. It found expensive natural gas explains almost 90 percent of the rise in electricity bills. The typical electricity bill climbed about £180 a year, and £161 of that was wholesale power. Combined gas and electricity bills rose from £1,175 to £1,723 a year, a 47 percent jump.
The reason is how the UK sets power prices. In that market, the last plant needed to meet demand sets one price for everyone, and that plant is often gas-fired. Nesta’s Andrew Sissons says rising gas prices, not net zero, drove most of the surge. Forecasters also think the price cap could jump again in January.
Cochrane notes gas prices are rising at the pump too. Fuel ran around $3.20 to $3.50 two months ago, and today he is paying $4.79. Oregon, he adds, was just as bad.
Iron at Earth’s Core May Take a Surprising Shape
Science magazine’s Paul Voosen reported in an August paper about Earth’s inner core. That solid ball of mostly iron and nickel sits about 3,200 miles down. For decades, scientists assumed iron that deep stacks its atoms in hexagonal layers. Instead, this team saw it switch to a cube pattern, the same arrangement ordinary iron has at the surface.
To recreate core conditions, researchers squeezed a speck of iron between diamond tips at the European XFEL, an X-ray laser near Hamburg. The cube form appeared at about 2.3 million times normal air pressure and above 6,700 degrees Fahrenheit. If it holds up, it could help explain why earthquake waves cross the inner core up to 8 percent faster pole to pole.
However, the lab reached only about 70 percent of core pressure, using pure iron, and the X-rays themselves may have affected the result. Lead researcher Sébastien Merkel of the University of Lille calls it an open question whether this iron exists in the core. Cochrane notes it is nothing definitive, but still a very interesting idea.
Euclid Discovers Its First New Comet
The European Space Agency’s Euclid telescope found its first previously unknown comet. Euclid’s real job is mapping billions of galaxies to study dark matter and dark energy, so moving objects are just noise. Helsinki PhD student Mikko Pöntinen wrote software to catch them anyway. In images from September 16 to 24, it flagged a fuzzy streak across 16 exposures.
The Minor Planet Center confirmed the find on October 8 as comet C/2026 S1 (Euclid). It sits about 800 million miles from Earth, between Jupiter and Saturn in distance from the Sun. One trip around takes thousands of years. Euclid scientist Bruno Altieri called it a happy coincidence, and Cochrane finds it mind-boggling to spot a comet that far out.
Hubble Scouts Gravitational Lenses for Roman
NASA released a new Hubble image of a gravitational lens, part of its groundwork for the Nancy Grace Roman Space Telescope. In a lens, a massive galaxy bends light from something farther away. Here, a galaxy 4.5 billion light-years away bends light from one 8 billion light-years out, so it appears twice. The bending also reveals more mass than the visible stars can explain, which points to dark matter.
Roman launched August 30 on a SpaceX Falcon Heavy, about eight months ahead of schedule. Each image covers at least 100 times more sky than a Hubble shot, and science should start in 2027. A study predicts Roman could spot more than 160,000 lenses. For a bit of trivia, Nancy Grace Roman was NASA’s first chief of astronomy, known as the mother of Hubble.
Was The Starry Night Painted in July?
Scientific American’s Emma Gometz covered a push to redate Vincent van Gogh’s The Starry Night, long dated to mid-June 1889. A new paper argues the painted stars are the Hyades in Taurus, not stars in Aries. Using software and old weather records, the team found its best match around July 22. Notably, the moon was a thin crescent then, as in the painting, but more than half full in mid-June.
Lead author Elijah Jeong-hyun Kim of Kyung Hee University told the AP he would bet on that date. However, Texas State physicist Don Olson says Venus’s position doesn’t match. The Van Gogh Museum is sticking with June, noting Van Gogh had a breakdown around July 22 and could not paint for about a month. Cochrane wonders how anyone can pin the date so confidently, and he feels there could be more to it.
Nikon Small World: Printer Ink Wins, an AI Video Gets Booted
Quanta Magazine’s Molly Herring gathered winners from Nikon’s Small World contests, which have honored microscope imagery since 1974. Ole Bielfeldt, a student in Cologne, Germany, won first place in photos. His shot captures ink flying inside an inkjet printer at 20 times magnification, frozen with a flash in a dark room.
The video contest had a shake-up. PetaPixel reports Nikon disqualified the original winning video for breaking its rules on generative AI. Cochrane can’t believe someone cheated with AI to win a photography contest, and still got caught. The new winner is Nguyen Nam Nhat from Vietnam, who filmed a single-celled creature and a tiny worm at 40 times magnification.
Another standout came from fungi scientist Patrick Hickey, who filmed cells from a houseplant clipping on his kitchen windowsill. Green mitochondria weave past red chloroplasts in the footage. Cochrane calls many of the images stunning, a glimpse of a world we never see.
Scientists Film a Mosquito Bite in Five Stages
Phys.org’s Krystal Kasal covered a Johns Hopkins study in Science Advances that zoomed in on the bite itself. That is the moment malaria parasites and viruses like dengue get into the body. The team tested Anopheles, a major malaria carrier in Africa, and Aedes aegypti, which spreads dengue. A high-speed camera with AI tracking filmed above the skin, while a gold wire on each mosquito closed a tiny circuit through the volunteer.
It turns out a bite has five stages: pierce, hunt for a vessel, drink, pull back and pull out. Anopheles found a vessel about 17 seconds faster, and its bites were always noticeable, while Aedes pierced painlessly. The whole study rested on one volunteer. Cochrane calls that hardcore, and he would never volunteer himself.
Childhood Brain Scans Hint at Teen Anxiety
Nature’s Max Kozlov reported on nearly 30,000 brain scans from about 11,700 American kids, taken every two years from age 9 to 16. The cortex thins through the teen years, and researchers mapped when each region finishes. Vision areas wrap up first, while frontal areas for planning and emotion finish last. Girls also thinned faster than boys in 66 of 68 regions.
Kids whose sensory areas were still thicker at 9 or 10 tended to have higher anxiety and depression scores about four years later. Those scores came from parent questionnaires, not diagnoses. Rutgers neuroscientist Avram Holmes calls the effects slight and subtle, and the paper is an unreviewed preprint on bioRxiv. Even so, Cochrane hopes researchers keep digging into how the brain develops.
Chicago’s Windows Kill or Injure 1,000 Birds in One Weekend
Smithsonian Magazine’s Sarah Kuta reported that Cornell’s BirdCast radar estimated more than 5 million birds crossed the Chicago area on October 16. Over the next two days, Chicago Bird Collision Monitors collected more than 1,000 dead or injured birds below windows downtown and in Evanston. City lights pull migrating birds in, and glass can look like open air or mirror the sky. Cochrane calls the toll brutal.
Across the US, buildings kill up to a billion birds a year. Group director Annette Prince points out that the birds reaching Chicago are the fittest, the ones doing everything right. In 2023, McCormick Place lost close to 1,000 birds in a single night. It then added dotted window film and pledged to cut its lights, and deaths fell more than 90 percent the next fall.
Chicago’s bird-safe building rules remain voluntary, unlike those in New York and Washington, DC. A stricter city ordinance is being rewritten in committee.
Cochrane wraps up with housekeeping. Listeners can become a GNC Insider at geeknewscentral.com/insider or email geeknews@gmail.com to reach Ray or Chris. He also points to the newsletter at geeknewscentral.com and modern podcast apps at podcastapps.com. Finally, he thanks GoDaddy for more than twenty years of keeping the show on the air.
The post The Web Pulled Its Own Plug #1881 appeared first on Geek News Central.