CISOs, IT teams, and sysadmins worldwide are tackling what more than one security researcher has called “the vulnerability apocalypse”.
From out-of-bounds AI agents to a tide of AI-found vulnerabilities, the pace of patching and remediation is proving a challenge for many, and even darknet forum admins are not immune.
“I'm getting really f**king tired of needing to redeploy core in what seems like every other week now. Let's hope we got all the critical stuff done now?”
This was the opening line of a recent post from one of the administrators of Dread, the largest forum on the darknet and dedicated pretty much to darknet things: advertising darknet drug markets, promoting various illegal or semi-legal activities, and generally known as the “Reddit of the darknet”.
But even it is not immune to the trials of the modern threat landscape, particularly the recent PHP vulnerabilities known as PHP2Shell.
“CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities which were found by AI, now openly exploited, and allows unauthenticated attackers to execute code within PHP's engine itself. It doesn't matter what kind of application you have these vulnerabilities are caused by memory handling and stale global state,” the admin said last week.
“To put simply, it is really f**king bad. As bad as you can get where the only real limit is based on if you could implement the vulnerability. The PHP Foundation knew of these memory flaws back in 2024 but couldn't find a way to exploit them. AI made that possible and easy enough to do. Within a few hours of the CVE getting leaked there were active attacks already using it. Once the fixes were released in the last five hours it is trivial to reverse engineer the latest patches to find the full chain and build a system to exploit it.”
It’s worth noting that this talk of active exploitation was a full week before CISA added the PHP bugs to its Known Exploited Vulnerabilities Catalog.
“This is a different world now. I've been in this field longer than most of you have been alive and the speed of these things are getting [sic] is mind blowing. What would have taken at least a few days if not a week for an expert team to find and exploit is now taking a few hours if that. If you search what Dread is built on, we use PHP for the core. This hasn't changed since the site was first made. There is tons of isolation, containerisation, and process jailing, but you can only do so much when the dependencies you count on are vulnerable themselves. Machines will do what you ask them to do as long as you say it in the right way,” the admin added.
Thankfully, like any good, community-minded darknet operator, this Dread admin does have some good advice for everyone else struggling to keep up.
“This should be a good reminder that you can never trust that something is fully safe and secure. Specifically if it is open to the Internet,” they said.
“Do not trust us to keep your personal information safe, don't even provide it to us in the first place. We do not want it. We do not need it. Do not trust us. Even if we are not compromised nothing says the things we depend on are not. Do not put yourself at risk.”
“Welcome to the new world. It is going to get worse before it gets better.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
