Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships

What it is

This is a Galaxy Research newsletter section by Thad Pinakiewicz on PHP2Shell, two decade-old PHP remote code execution bugs affecting nearly every version back to 5.4 (released 2012). The page is commentary, not an advisory. It gives no CVE IDs, no fixed version numbers, no bug mechanism and no commands. Engineers need the PHP project's own release notes for the patched versions.

Details beyond the summary

• Discovery. Wiz and Calif found the bugs with help from OpenAI, through OpenAI's Patch the Planet program, in early August. The page says Calif used GPT-5.6 Sol, a generally available model.
• Earlier scan missed it. The PHP Foundation had already worked with outside firms to scan its code with Anthropic's Claude Mythos this year. The page says that scan did not surface these bugs.
• Timing. Pinakiewicz cites Mandiant's figure of a mean time-to-exploit of negative seven days. On that figure, attackers typically strike a week before a patch exists. Pinakiewicz argues that pre-announcing a patch now works as a starting gun for attackers.
• Government response. The NSA and FBI told organizations that could not patch to go offline. Finland and several other European governments pulled sites preemptively, and the St. Louis Fed's FRED site went dark.
• Other incidents that week. The page lists a CVSS 10.0 GitLab bug, Node.js patches, Plex servers exploited to mine crypto, and SafePay ransomware. It also reports that Railway paused all deployments after someone got into its environment-variable store. eMudhra, an Indian certificate authority, generated private keys small enough to guess, and one was the number 4. None of these has an identifier or fix guidance.

What to do

The page states little that is concrete.

• Patch PHP, or take the host offline if you cannot, as the NSA and FBI advised.
• Pinakiewicz, writing for crypto clients, recommends verifying instructions by signing from a wallet, as a safeguard against compromised intermediaries.
• Pinakiewicz also took a personal home server offline and unplugged IoT devices until they can be patched or reflashed.

Caveats

• The claim that the bugs were found with GPT-5.6 Sol is the author's account of OpenAI's statement. No independent confirmation is given.
• Pinakiewicz argues that human-only security is obsolete and that defence must be agentic. This is opinion, not a finding.
• The Amazon honeypot attempt four days before disclosure and Matthew Prince's counts (thousands of attempts in the 10 hours before the patch, millions by evening) are reported without primary sources.