Innovative senior software engineer with 7+ years of experience in developing cutting-edge web and mobile applications. Ask me about JavaScript, PHP & Dart.
Ibadan, Nigeria
Joined August 2015
- Tweets4.5K
- Following674
- Followers1.2K
- Likes6K
Hammed Oyedele retweeted
This blew up. 😅 Anyway, if you work at a company that makes decent money off of PHP tell your boss to consider sponsoring the PHP Foundation: @ThePHPF 💜
Hammed Oyedele retweeted
The recent drama this week highlights how vital PHP remains. Across global government sites, banks, schools, social media, video game firms, and news outlets, organisations either closed or issued statements about applying the patch.
Even the prime minister of Japan released an official comment on the incident remarkable events.
If PHP were truly dead, this vulnerability would have passed largely unnoticed, yet everyone is discussing it, including people who are not programmers. “PHP is dead. Who even uses PHP in 2026?” Well, roughly half the internet.
Hammed Oyedele retweeted
The #php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff: daubois.dev/blog/cve-2026-10…
Hammed Oyedele retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.
Hammed Oyedele retweeted
🔒 Elephc 0.27.5: security release.
Fixes upload-progress session-file injection and use-after-free between web requests.
Using --web? Update the compiler and rebuild your apps.
Release notes: github.com/illegalstudio/ele…
Advisory: github.com/illegalstudio/ele…
Hammed Oyedele retweeted
I've been managing PHP servers since 2004 and I've never had a day like today.
I learned a lot and I want to keep improving. Our release process needs to be faster, and I took a second to reflect.
We're foolish to think this is the last critical patch
github.com/serversideup/dock…
Hammed Oyedele retweeted
We've sponsored oerdnj and the @ThePHPF on Github today because these folks have had it much harder than us and we need them. 🫶
github.com/sponsors/oerdnj
github.com/sponsors/ThePHPF
Hammed Oyedele retweeted
My colleague made a website to check if your website is vulnerable to PHP2Shell: php2shell.aikido.io/
We're also releasing PHP images with backported patches for free: gallery.ecr.aws/aikido-dev/p…
Stay safe!
Hammed Oyedele retweeted
An unprecedented day in my history with PHP.
Some bumps along the way, but really proud of the @laravel team for working through the night ensuring all of our products and customers had patches available to them and, when possible, applied automatically.
Given the advancement of agents, it's quite possible this won't be the last time this happens, and it's likely PHP won't be the only language that goes through this. We built some solid muscle today to do even better next time.
Onward. 🫡
Hammed Oyedele retweeted
Explaining to my wife how there's this one guy. And he alone is responsible for most of the world's distribution of PHP. And if anything happens to this guy, that's just it. Everyone is screwed.
Hammed Oyedele retweeted
Laravel Cloud:
We are actively applying PHP security patches across the final two Cloud regions, Ohio and Frankfurt.
Edge network mitigations of the vulnerability remain in place even for the unpatched regions, providing protection to all customers at this time.
Deployments remain paused during this process and will resume once all regions are patched. No action is required on your part.
Laravel Vapor:
PHP runtime images have been updated with the security patches and are available now. If you would like to apply the patch immediately, you can trigger a redeploy of your application.
Automatic redeployment of PHP 8 applications is in progress - we will update this page once that is complete. Docker runtime customers should continue to monitor as updated images are still becoming available.
Laravel Forge:
PHP has been updated across Forge servers. We are currently working through a high volume of queued update jobs - if your server has not yet received the update, it will shortly.
If you need to apply the update immediately, you can do so by accessing your server directly via SSH and following our guide: laravel.com/forge/docs/knowl…
Upstream Launchpad PPAs have not yet received patched PHP release.
Envoyer:
Envoyer is currently offline for maintenance as part of today’s PHP security release. We are updating the underlying servers to versions that support the patched PHP releases. We will update this page as soon as Envoyer is back online. We apologize for the disruption.
Hammed Oyedele retweeted
If you run PHP or Node.js in production, check your servers today.
Critical PHP vulnerabilities and new Node.js security advisories are a reminder that writing code is only half the job. Keeping your infrastructure secure is part of being a software engineer.
May God help the government websites...
Hammed Oyedele retweeted
They even released patches for no longer supported PHP versions. Absolute legends.
Hammed Oyedele retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Hammed Oyedele retweeted
elephc v0.27.4 is out, with ~20 performance wins and a native test runner 🐘
• `elephc test`: run your tests natively
• Full BCMath, BcMath\Number included
• PHP 8.5 classes & constants complete
• Tail recursion compiled to loops
• FFI: explicit C int widths + f32 (breaking)
• Notarized macOS binaries
github.com/illegalstudio/ele…
A ⭐ on the repo would be much appreciated!
Hammed Oyedele retweeted
Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation.
(generated and validated by LLM)
1️⃣ Do this first. In php.ini or the FPM pool, set:
session.upload_progress.enabled = 0
Reload PHP-FPM, then update PHP right after the release (21 Oct, 14:00 UTC).
2️⃣ Edge block until you patch. It blocks the PHPSESSID cookie and query (also lowercase and URL-encoded), and all multipart/form-data requests.
⚠️ File uploads stop working until you remove it.
☁️ Cloudflare (WAF custom rule, action Block):
(lower(url_decode(http.cookie)) contains "phpsessid") or (lower(url_decode(http.request.uri.query)) contains "phpsessid") or (any(lower(http.request.headers["content-type"][*])[*] contains "multipart/form-data"))
🟩 nginx (http {} context):
map "$http_cookie|$args|$content_type" $block_php2shell {
default 0;
"~*(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)" 1;
"~*multipart/form-data" 1;
}
In each server {} block:
if ($block_php2shell) { return 403; }
🔒 Caddy:
@php2shell expression `{header.Cookie}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {query}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {header.Content-Type}.matches("(?i)multipart/form-data")`
respond @php2shell 403
🚦 Traefik v3 (Coolify: Server > Proxy > Dynamic Configurations). Add this to the https router and also to a copy for the http entrypoint:
http:
routers:
block-php2shell:
rule: "HeaderRegexp(`Cookie`, `(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)`) || QueryRegexp(`PHPSESSID`, `.*`) || HeaderRegexp(`Content-Type`, `(?i)multipart/form-data`)"
priority: 100000
entryPoints: [https]
middlewares: [deny-all]
service: noop@internal
tls: {}
middlewares:
deny-all:
ipAllowList:
sourceRange: ["255.255.255.255/32"]
✅ Test:
curl -s -o /dev/null -w '%{http_code}\n' -H 'Cookie: PHPSESSID=x' https://your-app → 403
curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-app → 403
The edge block does not protect direct origin access. Disable upload_progress and patch PHP.