A web software flaw leaked early, and experts say secrecy needs a rethink

Attackers were already using a serious flaw in PHP, widely used web software, before anyone announced it. Columnist Rupert Goodwins of The Register says that points to a leak from someone who knew the details. He argues the way the tech industry shares security secrets has to change.

What happened

The flaws are known as PHP2Shell. The first attacks were seen days before an anonymous post on Hacker News revealed the problem and how bad it was. That post carried the correct bug ID numbers, called CVE numbers. Goodwins concludes it came from someone in the loop.

He also says AI tools played a role. They helped identify the mix of problems and how to exploit them over a few days in August. Finding the flaws took days, not months. Attackers then exploited them within hours.

Why it matters beyond PHP

PHP started in the mid-1990s and still carries design choices from more than 20 years ago. Goodwins says it is not alone. Many projects put speed and new features ahead of cleaning up old internals, until the bill comes due. He expects more days like this.

Related Register coverage says dozens of UK government services were knocked out of service. It also reports that AWS said attacks began before disclosure.

What the writer wants changed

The usual approach is to share fixes privately with major, trusted organizations first, then go public once core services are protected. Goodwins says that only works if very few people hold the secret. He points to wartime codebreaking, where access was tightly controlled. His ideas include:

• Treat disclosure as a discipline, with the fewest people possible knowing.
• Make patch liaison a real job with training and qualifications.
• Rank who hears first by the quality of their liaison person.
• Build tools to roll out fixes without announcing them.
• Create a forum to decide fast on risky core software, such as whether to rebuild PHP in Rust.

What to do

Many sites you use or run may rely on old software. If you have a website or a web provider, ask how quickly they apply security fixes. A fast, clear answer is a good sign.

What is not known

The material does not say who leaked the details. Goodwins gives his view, not a proven finding. His proposals are ideas, and no industry body has adopted them.