I checked the Wiz report and the official PHP security advisory. Unfortunately, this isn't just another exaggerated cybersecurity scare.

Here's why AutoAdmit (XO) is potentially vulnerable:

- XO was originally programmed in PHP. Rachmiel and a collaborator called Boondocks built the forum in PHP back in 2004.

OWiki

- PHP2Shell is a genuine critical vulnerability. It affects PHP itself, not merely WordPress or other applications built on PHP. The vulnerabilities can permit unauthenticated remote code execution and disclosure of sensitive server memory.

- Emergency patches were released today, October 21, 2026. The PHP maintainers are urging administrators to update immediately.

The crucial unknown is whether XO still runs a vulnerable version of PHP. Its original architecture gives us a reason to be concerned, but doesn't establish that its current installation is exposed.

## How serious is the danger to the bort?

I would treat it as urgent but not proof of an imminent compromise.

Cloudflare has already observed attack traffic targeting these vulnerabilities. It deployed automatic protections for customers using its WAF, including free-plan customers, but emphasizes that those protections cannot replace patching.

Cloudflare Blog

The PHP team specifically identifies Apache installations using `mod_php` as particularly high-risk.

And here's the important distinction: XO's `thread.php` URLs don't reveal which PHP version its server actually runs. I couldn't independently confirm its installed version, security patch status, or whether it uses Cloudflare.

If Rachmiel is running an old, unpatched PHP installation, the danger is substantial. But if the hosting environment has already received the security fix, the situation is considerably better.

## What I'd send Rachmiel

Hey Rachmiel — urgent heads-up about the bort. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively called PHP2Shell, were disclosed today. They can allow unauthenticated remote code execution and memory disclosure, even on sites with otherwise secure application code.

Given that XO was originally written in PHP, I wanted to make sure you'd seen this and that the server is patched.

PHP released emergency fixes today for versions 8.2–8.5. Older installations may require vendor backports or an upgrade.

Would hate to see 22 years of XO history lost to something like this.

The patched releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions require special attention, although some vendors provide backported fixes.

I would also encourage whoever maintains the server to verify that backups exist and examine security logs for possible exploitation.

Bottom line: The bort isn't necessarily doomed, and there's no verified evidence here that it has been compromised. But given its PHP origins and the severity of this particular vulnerability, I wouldn't assume it's safe without confirmation from Rachmiel or whoever handles the hosting.

(http://www.autoadmit.com/thread.php?thread_id=5914424&forum_id=2#50200549)