So this is the person who tweeted about a PHP vulnerability. I think they'll be remembered as the one who sent the whole world into a death march.

What happened

A researcher known as J4ck3LSyN shared technical details and a working demo (called a PoC) of two serious PHP bugs on X on October 21, 2026. This was before a patch existed. PHP is a common language used to run websites, so many sites were at risk. The bugs let an attacker run their own commands on a server without logging in. The leak started earlier, when someone on Hacker News posted that the bugs would be made public soon. Many people then tried to recreate the attack, and the details spread widely.

Key facts

• The two bugs are CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell.
• Severity score: CVSS 9.2 (the scale goes up to 10.0). The bugs allow remote code execution without authentication.
• The PHP team released an emergency patch earlier than planned, on October 21 at 14:00 UTC.
• In Japan, pixiv, DMM, and niconico paused or did emergency maintenance. The national cyber office and Prime Minister Takaichi asked sites to pause if they could not patch quickly.

Why the timing matters

Security researchers usually use coordinated disclosure. This means they tell the software maker first, wait for a fix, and only then share details. An embargo is a agreed period when information must stay private. In this case, the embargo was broken early. Once the details were public before the patch, attackers could use them right away, leaving website owners almost no time to respond.

Why it matters

This story shows how fast a single leak can put the whole internet at risk. Many engineers had to work through the night, and some people online called for serious punishment. Others said the researcher was only trying to get credit. The case is a warning that sharing security details too early can hurt many people, not just the company that made the software.

What to watch

• Whether attacks using these bugs increase, especially on sites that have not updated yet.
• How the PHP team, the researchers, and the people involved explain what went wrong.
• Whether any legal action or official investigation follows.
• Changes in how security researchers share bugs before patches are ready.