One topic showed up independently across all three sources I track in the week of 19–26 October. That is a stronger signal than any star count: multiple groups, without coordinating, writing code about the same problem.
What the bug is
CVE-2026-109618 and CVE-2026-109619 sit in PHP's `session.upload_progress` handling — an old feature, enabled by default in many configurations. The flaw is a heap use-after-free leading to pre-authentication remote code execution. The CVSS figure cited in coverage is 9.2.
How it took three boards
- GitHub: 33 of the week's 615 new repos relate to it — 5.4% of repos but 9.6% of all stars (9,172 stars). 23 of the repos are Python.
- Show HN: “Steal My Bitcoin” led the velocity board with 593 points and 439 comments — a site deliberately holding real money for anyone who can exploit it.
- Lobsters: “I want my Wednesday back” (115 points, 31 comments) argued the opposite: the bug is serious, but the “patch within 15 minutes” warning is overblown.
The two sides disagree, and both are right
Security vendors said patch now. The Lobsters post counted what an actual exploit costs: the best proof of concept needs four *consecutive* requests hitting the **same PHP worker**, and requires knowing the exact build (PHP version, OS, architecture).
`9bie`'s PoC takes the default Docker image with 150 workers, opens 149 connections sending half a request to keep the other workers busy, then attacks worker 150. Against a real site behind a load balancer with several containers, you must guess the worker count and try 50 PHP/OS combinations × worker counts from 10 to 1010 — roughly 50,000 attempts, each taking 3–4 seconds on localhost, optimistically 10 seconds over the internet. That is days of brute-forcing, and close to a self-revealing DoS.
That post's conclusion: a critical bug that must be patched, but recommending downtime for live sites was an overreaction — and if “take it down” becomes the reflex for every complex critical bug, the advice will be ignored the next time something Heartbleed-shaped appears.
Then it was exploited for real, 19.28 hours in
The same author updated on 26 October: stealmybitcoin.com — a site holding $2,021 of real money — was not vulnerable for the first 20 hours, then was drained within hours using a different PoC. The technique differs: send one producer request, then pipeline consumer requests across all workers to reduce the chance of stray requests interfering. The precondition is knowing the exact worker count.
That is the cleanest answer to the argument: the bug is not mass-exploitable, but it is exploitable enough to take one target that holds real money, provided the target runs a simple configuration and you are willing to grind. The bounty itself is a separate post.
Sources: I want my Wednesday back (updated 26 October 2026), 9bie's PoC, KillaBoi's PoC, NCSC-NL, GitHub data as of 26 October 2026.