Earlier this month, two major vulnerabilities in PHP, a programming language used across roughly 70% of the web that went unnoticed for several years, were discovered by researchers using AI tools. This discovery, called PHP2Shell, was quickly followed up by the discovery of yet another emergency vulnerability for Windows systems.
Developers worldwide scrambled to release patches for both vulnerabilities, but there are still many systems that have either been left unpatched, or in some instances, are so outdated that they’re no longer receiving updates, but still maintain the same vulnerability.
What is PHP?
PHP is a programming language that can be used to serve dynamic content on websites, operate industrial components, facilitate transaction-signings, and powers widely known applications and platforms including Facebook, WordPress, Slack, Magento, Wikipedia, Etsy, Tumblr, and Mailchimp.
Needless to say, a large-scale vulnerability within such a widely-used ecosystem means that much of the internet has been in the crosshairs of hackers seeking to exploit it.
Why did these vulnerabilities take so long to discover?
Open source programming, where source code is freely available to edit, update, or modify, often relies on large groups of volunteers or private contributors. This method is widely touted as being more secure than closed-source software, where code is not shared with the public and is generally owned and operated by a single entity.
The reputation for greater security is due to the sheer number of people with access to the code, but can also mean that vulnerabilities or glitches can hide (and have been hiding) in plain sight. As AI becomes more proficient with analyzing software and networks for vulnerabilities, many other long-standing holes in security have been discovered at a significantly higher rate.
Are these vulnerabilities a big deal?
There are three primary factors that led to the global scramble:
- PHP is everywhere: Countless websites, content management systems, e-commerce platforms, applications and widely-used services are developed with PHP or use it in part. Bottom line: Much, if not most of the internet as we know it was found to be vulnerable to these exploits.
- The timing of the release: The PHP project, which is the open-source group that maintains and updates PHP, was initially aware of the vulnerability and had scheduled a release of the patch on October 22, 2026. News of the vulnerabilities was leaked as late as October 20 and possibly as early as October 17. This effectively gave anyone seeking to exploit them a head start over administrators who had neither been notified nor had received the patch.
- The severity of the vulnerabilities themselves: If successfully exploited, the vulnerabilities look like a Christmas wishlist for hackers. Remote Code Execution (RCE), deployment of malware, exfiltration of data from system memory, Denial of Service (DoS) attacks, and the ability to cause system crashes are within the realm of possibility.
What does this mean for consumers?
Even if you had never heard of PHP and have never written a line of code, the vulnerability is still relevant to anyone online.
What can end users do about the vulnerabilities?
Unless you’re an IT administrator, there’s not much direct action you can take. However, every organization using PHP has an absolute obligation to apply the patches.
While the worldwide attempt at patching systems may have mitigated the worst of the effects, there’s still the possibility of widespread errors, outages, and cyber compromises in the weeks to come, particularly for those who haven’t read the memo (remember the Equifax breach?).
