PHP RCE Flaws Put Legacy Applications at Risk as Timekeeping Plans Change

Two newly disclosed PHP flaws and a proposed change to global timekeeping point to the same operational lesson: systems can fail at boundaries their designers rarely encounter. For application teams, the immediate issue is patching PHP. For incident responders, the less familiar reminder is to exercise plans against conditions that have never occurred before.

Why leap seconds have become an engineering problem

Earth’s rotation varies, even as atomic clocks provide a highly consistent measure of time. Coordinated Universal Time (UTC) is based on atomic time, so leap seconds were introduced in 1972 to keep it aligned with the planet’s rotation. A second can be added or removed when the difference grows large enough.

Since the system began, 27 seconds have been added; none has been removed. That history matters because software and infrastructure have had to handle the added second, but not a negative one. In 2012, an added second caused failures across several systems, including Reddit. A correction in the opposite direction could pose a different and untested challenge.

The Earth has been rotating faster over the past decade, with changes in its core cited as a factor. If that pace continues, timekeepers could face the first need to remove a second. The plan described in the newsletter is to replace leap seconds starting next May with a “leap hour”: UTC would be allowed to drift as much as an hour from Earth’s rotation before a correction. The change is intended to avoid frequent small adjustments; the larger correction is not expected within current readers’ lifetimes.

The practical point for engineering teams is less about predicting when that hour arrives and more about testing assumptions. “It’s never happened before” is a reason to run an exercise: systems may depend on a clock, timestamp, or recovery step behaving in a way that the scenario breaks. The newsletter also raises the open question of how automated systems, including AI tools, would respond to a missing second.

PHP vulnerabilities need prompt attention

The week’s more immediate security issue is a pair of unauthenticated remote code execution flaws in PHP, referred to as “php2shell.” The source says they can be triggered with a simple HTTP request and affect every build since PHP 5.4. Talos assesses that organizations across industries using PHP applications face exploitation risk if they leave affected systems unpatched.

The exposure is broad because PHP supports widely used platforms including WordPress, Drupal, Magento, Shopware, and WooCommerce. Older PHP branches have reached end of life and will not receive fixes; the newsletter estimates these may account for around half of use cases. Talos strongly advises organizations running PHP 8.1 or earlier to update to PHP 8.2 or later, noting that no patch is available for PHP 8.1 and older versions.

Cisco Talos says its Network Intrusion Prevention signatures 67359 and 67360 cover the flaws for Cisco customers. Teams should consult Talos’ technical guidance for specific coverage and detection details. The article also points readers to an interview with Nick Biasini on defending against php2shell.

Other security stories to track

This week’s linked coverage includes reports that security teams are working to address the PHP flaws after technical details surfaced alongside claims of exploitation attempts. Another story describes seven exposed servers associated with INC and The Gentlemen ransomware affiliates, reportedly containing AI conversations, stolen credentials, and 46 encryptor builds.

Two articles examine AI security from different angles. One argues that risks from large language models can be tested and managed using established security practices. Another reports that deceptive “context bombs”—prompts that steer AI agents toward fake targets—reduced attack success by up to 91% in tests and raised the cost of a successful attack 23-fold. Those figures are specific to the reported tests; they don’t establish how the approach will perform across other systems.

Talos research and upcoming events

Talos also highlights research on eight compromised intermediate certificates belonging to eMudhra, and on attackers abusing more than 25 legitimate services over the past year to deliver malicious activity. The services included collaboration, file-sharing, and payment platforms, where existing user trust can help activity blend into normal workflows.

A separate piece examines a sharp increase in vulnerability advisories: 975 in the September Microsoft Patch Tuesday release and 1,415 in the month covered, compared with a pre-June average of 100 per month. The piece asks where the increase came from and what it may mean for future vulnerability tracking.

Listed events include CAMLIS in Arlington, Virginia, October 21–23; SecurityOnion Conference in Augusta, Georgia, October 23; BsidesAugusta on October 24; and SAINTCON in Provo, Utah, October 26–30. Later listings include CYBERWARCON in Arlington on November 20, AVAR 2026 in Hyderabad on December 2–4, and Black Hat Europe in London on December 7–10.

Malware files in Talos telemetry

The newsletter lists four files seen in Talos telemetry over the past week. The first has SHA-256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507, MD5 2915b3f8b703eb744fc54c81f4a9c67f, example filename sample.exe, and detection name W32.9F1F11A708-100.SBX.TG. Its Talos reputation entry provides the file record.

The second file is 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f (SHA-256), with MD5 cca616647db9370c88998ae25da6997f, filename cca616647db9370c88998ae25da6997f.exe, and detection Win.Tool.Kmsauto::1201. Its reputation entry is available online.

A third entry lists SHA-256 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9, MD5 485055033bcddfde56325c0d2feea4f2, filename 485055033bcddfde56325c0d2feea4f2.exe, and the same Win.Tool.Kmsauto::1201 detection. See its Talos record.

The fourth has SHA-256 d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1, MD5 0c883b1d66afce606d9830f48d69d74b, filename d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe, and detection Win.Worm.Zard::95.sbx.tg. Its reputation page contains the related details. For teams, the near-term takeaway is clear: update unsupported PHP deployments and test response plans against failure modes that routine operations may never reveal.