Finlay Moss

[Noah Chander @NoahChander]

Wake up folks! The FBI, NCSC, and NSA issued an urgent warning to organizations globally running PHP to take immediate action.

PHP runs 70% of the internet. Two new critical bugs (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a web server with NO login and NO user interaction.

> memory corruption
> memory corruption
> memory corruption

Both bugs are written in C, and both slipped past years of review, fuzzing and hardening. AI had other ideas.

Patching will fix this sure, but it doesn't fix the next bug that we don't know about, and patches will come too slow in MOST cases.

At Cofibrant, we've already solved the worst of this. Our compiler extension compiles any memory-unsafe code (C/C++/COBOL/Fortran) and makes memory corruption exploits impossible. No code changes, no performance impact on modern hardware.

0% performance overhead vs Fil-C at 400%
40x more precise than Google + Microsoft's CFI
Sits automatic in CI/CD, no annoying flashing lights and buttons for developers to triage.

If you're responsible for C or C++ software that can't afford to be next, let's talk.
#cybersecurity #PHP #memorysafety #appsec #arewegonnamakeit?

[Finlay Moss @FinMoss_]

PHP2Shell is memory corruption in the C underneath your PHP application.

You don't have to write C to inherit its memory-safety bugs.

This is the problem we're working on at Cofibrant.