Summary
Two serious PHP vulnerabilities were disclosed last week, and this Computerphile episode explains what happened and why it mattered. Security researcher Steve walks through the chaotic disclosure, in which details were posted to Hacker News and an exploit video leaked before the planned embargo ended, forcing a rushed round of patching across the web.
The video starts with a primer on PHP, the server-side language that builds web pages dynamically and still powers a huge share of the internet. It then explains in general terms how PHP’s worker threads handle HTTP requests and how leftover state in those workers can be abused to run attacker-controlled code on the server.
To show the flaws are real, the presenter runs a publicly circulated Python exploit, originally released by a Chinese group, against a local PHP web server. The exploit writes the web server’s user ID, www-data, to a file, demonstrating arbitrary code execution. He also notes that exploitation is difficult in practice and that the PHP team had identified at least one of the issues back in 2024.
The episode finishes with a discussion of the aftermath, including how quickly the industry responded and what the episode says about vulnerability disclosure.
📺 Source: Computerphile · Published October 28, 2026
🏷️ Format: Deep Dive
