In the 4 days since php2shell was published: * 1,448 more CVEs published. * No published exploit code for any in Metasploit or Exploit-DB. * VulnCheck added 25 on its KEV list. 24 are old bugs. * CISA added just 1 to its KEV list, the only new bug anyone has seen adversaries exploit. Nothing in the record shows AI or anything else driving up how many vuln adversaries exploit, or how fast. Adversaries keep working a small set of bugs until those stop paying, and only then move on. Patch php2shell because there are too many eyes are on it not to. Then apply the same rule to everything else, prioritize patching all systems against what adversaries exploit. It sounds simple, and the evidence says it’s what we still haven’t done that actually works.

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

Fear is the point. Intimidation is the point. And if the President can try to do this to me, he can do it to anyone.

PHP Patch, take it offline, or put it behind a WAF and hope it filters the exploit requests. I wouldn’t count on a configuration-only fix unless one is confirmed. For inventory, this Nmap command can reveal PHP versions exposed in HTTP headers: nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target> Only scan systems you’re authorized to test. This finds advertised versions, not every PHP server, and doesn’t confirm vulnerability.

Tonight, France burned. America, you should be watching very carefully. Today, October 17, 2026, more than half a million people marched across France against the cost of living. By 8pm, around 400 had been arrested. In Paris, police turned water cannons on the crowds at Place de la République, and one march was stopped 150 meters from the Élysée Palace. Of the 195 people arrested in the capital by the afternoon, only one actually lived in Paris. Mobs forced their way into the city halls of Marseille and Lille. In Lyon, a tourism office was set on fire. In Rennes, barricades burned. Near Limoges, a highway was blocked and police cars were torched. And then came Limoges. A crowd of very young people stormed the city hall, a protected historic monument built in the 1880s. They flipped police cars in front of it and set them ablaze, then set the building itself on fire. The flames took the roof, the wedding hall, and the civil registry, the office that records every birth, every marriage, every death in the city. Tonight, the bell tower that has crowned Limoges for nearly 150 years collapsed. The mayor's response: "It's a monument that is burning, not the Republic." That is the problem in one sentence. Our leaders still think words can put out fires. None of this came out of nowhere. For twenty years, the French political class has excused everything. Every riot was "anger." Every burned car was a "social symptom." Every attack on police was "a reaction to provocation." And the hard left, La France Insoumise, which officially backed today's mobilization, built its electoral machine on an alliance with political Islamism: refusing to condemn, refusing to name, trading secularism and public order for votes. In France we have a word for it. Islamo-gauchisme. Islamo-leftism. Tonight you saw where that culture of excuse ends. A country where a mob can burn down a town hall, and the state arrives after the roof has already fallen in. My dear American friends, I say this with love, as someone who has lived among you and owes you a great deal: your midterms are on November 3rd. And the same alliance is growing inside your Democratic Party. The same far-left wing that treats disorder as protest and police as the enemy. The same activists who refuse to draw a line between legitimate dissent and those who openly despise the West. The same politicians who think tolerance means tolerating everything, including the people who want to burn it down. It always starts with excuses. Then comes impunity. Then come the flames. Same causes, same effects. If you create the conditions we created, you will get exactly what we got tonight. France was the country of the Enlightenment, of cathedrals and town halls that stood for centuries. Tonight, one of them collapsed live on social media while the government called for calm. My dear American friends, the only advantage you have over us is that you've been warned. Vote like your city hall depends on it. Because one day, it will.

Western liberals imported the third world into France and other countries in the name of diversity and compassion. They ignored fundamental questions of assimilation and compatibility. They were told it would lead to this and they didn't listen. I pray that France, a beautiful country of amazing people, will stop this madness before more of its landmarks burn. And I hope Americans are paying attention. This is the future congressional Democrats seek for your country.