How PHP2Shell nearly broke the web and what comes next

Two vulnerabilities in PHP, the programming language behind roughly 70 percent of the web-facing internet, nearly triggered a catastrophic cascade of break-ins this week. The bugs, officially designated CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow attackers to infiltrate servers running PHP without needing a password or any other credential, then plant malware, steal data, or maintain long-term access for future exploitation.

The PHP Foundation released patches on Wednesday to fix the flaws. Yet security researchers and industry observers warn that the threat remains active: some systems remain unpatched, confirmed compromises have already occurred, and the incident underscores how much of the modern internet depends on decades-old, open-source software maintained by volunteers rather than well-resourced teams.

How Two Bugs Almost Broke the Internet

Discovery and the months-long embargo

Security researchers at Calif uncovered both vulnerabilities earlier this year as part of a security audit of PHP’s codebase. The work was undertaken through the Hack the Planet initiative, a collaboration between OpenAI and cloud security firm Wiz to find and fix critical security flaws in widely used open-source projects.

Initially discovered in 2024, the bugs were not considered exploitable at the time and sat unpatched. It took until 2026 for researchers to determine how to weaponize them. Once Calif demonstrated working proof-of-concept exploits, they alerted the PHP Foundation, which launched a coordinated disclosure process. The foundation placed patches under an embargo, held confidential until a specific deadline, giving large companies and web hosts a head start on installing fixes before malicious actors learned of the vulnerabilities.

What the bugs actually do

PHP2Shell enables remote code execution, meaning an attacker anywhere on the internet can take control of an affected system without first clicking on a malicious link, opening a compromised file, or otherwise tricking a user. The bugs eliminate the need for authentication: they allow unauthenticated access to servers that rely on vulnerable versions of PHP.

Once inside, attackers gain what amounts to full control. They can deploy malware, exfiltrate sensitive data, or establish a persistent foothold to return to later and execute additional attacks. The severity stems partly from PHP’s design: the language is memory unsafe, meaning it can leak sensitive information stored in the software’s memory. The National Security Agency reports that around 75 percent of all actively exploited vulnerabilities abuse memory-related flaws, suggesting memory-unsafe languages remain a primary target for attackers.

The scale of the affected ecosystem

PHP powers not only standalone websites but also WordPress, Drupal, Joomla, and MediaWiki, the platform behind Wikipedia. It runs on developer tools, command-line packages, routers, storage devices, firewalls, and VPNs. The language has endured for decades partly because it is free, relatively easy to use, and widely familiar to developers. Its usage has declined in favor of newer, more secure languages, yet it remains so entrenched that removing it from internet infrastructure would be neither practical nor feasible.

Exploitation Already Underway

Read also: PHP Flaw Exposes Internet’s Reliance on Aging, Fragile Code · Decades-Old PHP Flaw Exposes Internet’s Fragile Foundation · 1Password Lets AI Agents Log In Without Seeing Your Passwords

Pre-patch activity and the Amazon discovery

Despite efforts to keep vulnerability details confidential until Wednesday’s patch release, exploitation began before the embargo ended. Amazon, which monitors vast portions of internet traffic, detected PHP2Shell exploitation roughly a week before patches became available, around October 17. The company said in a blog post that it remained unclear how attackers learned of the bugs, but that defenders should look for signs of exploitation dating back to that date.

Several theories explain the early exploitation. One possibility: someone leaked details during the embargo period, either through a communication breakdown or deliberate disclosure. Another: attackers discovered the bugs independently or through espionage. The PHP Foundation initially blamed one company for pushing patches live hours before the embargo officially ended, though that timing does not fully account for the week-long exploitation window that Amazon observed.

Confirmed compromises and active attacks

By late Friday, security firms Palo Alto Networks and Trail of Bits confirmed that PHP2Shell had been actively used to compromise at least one system, with attackers conducting post-exploitation activity on an unknown target. Matthew Prince, chief executive of Cloudflare, which operates network monitoring infrastructure with visibility across a massive portion of the internet, reported exponential increases in exploitation attempts following the vulnerability’s disclosure.

Researchers note that turning a PHP bug into a usable exploit requires substantial effort and expertise. The complexity explains why mass exploitation has not yet materialized, though it also suggests that determined attackers with the necessary knowledge will eventually succeed. Smaller IT teams, independent developers, and companies that have not yet integrated patches into their products remain at particular risk.

A Pattern in Legacy Code

Why aging technology remains vulnerable

PHP2Shell fits into a pattern that security researchers expect to accelerate: critical vulnerabilities in decades-old technologies that remain foundational to internet infrastructure. These systems often share two characteristics: they were developed in an era before modern security practices matured, and they were built with memory-unsafe design patterns that create entire classes of exploitable flaws.

Python, Rust, and Swift represent memory-safe alternatives that prevent this broad category of attacks by design. Yet the internet remains dependent on older, memory-unsafe languages and tools including media and video codecs, compression libraries, and languages such as C and C++, alongside PHP. Migrating away from these technologies would require rewriting vast amounts of code across countless projects and organizations, a task that remains largely undone.

Open source maintenance and the funding gap

PHP and similar critical open-source projects often rely on volunteer maintainers who receive no payment for their work. Consequently, most cannot afford third-party security reviews or dedicated security teams. Companies that depend on these projects for their core operations have historically contributed little financial support, creating a fundamental tension: the internet’s infrastructure is built on volunteer-maintained code that lacks the resources to compete with the sophistication of modern attacks.

The Hack the Planet initiative, funded by OpenAI and Wiz, represents one attempt to address this gap by bringing professional security attention to critical open-source projects. Yet such initiatives remain episodic and limited in scope, covering only a fraction of the legacy code upon which the internet depends.

What Happens Next

The unpatched systems problem

Larger cloud providers and enterprise software vendors have already deployed patches or updated their platforms. However, countless smaller organizations, legacy systems that have reached end-of-life and cannot be updated, and internet-facing devices running embedded PHP will remain vulnerable for weeks, months, or indefinitely. Each unpatched system expands the potential attack surface for malicious actors seeking either immediate targets or long-term opportunities.

AI as both accelerant and discovery tool

Researchers at Calif emphasized that while AI assisted in developing the exploit, the bulk of the work relied on existing expertise in PHP’s codebase and exploitation history. Calif said in its writeup that no model is simply capable of unearthing all bugs with simple prompts, at least for now. Yet security researchers broadly expect that as AI tools mature and become better at code analysis, the discovery and weaponization of vulnerabilities in aging technologies will accelerate, potentially outpacing the pace at which organizations can patch and upgrade.

The broader internet risk

PHP2Shell joins a short list of internet-stopping events in recent memory. The 2016 Dyn botnet attack overwhelmed internet infrastructure with junk traffic. In 2017, North Korea deployed ransomware against the U.K. health system using leaked U.S. government hacking tools. A faulty CrowdStrike update in 2024 crashed most of the world’s Windows computers simultaneously. By all accounts, the internet narrowly avoided a similarly catastrophic outcome this week. Patches have propagated to a significant portion of systems, and mass exploitation has not materialized. Yet security researchers and industry observers warn that the window of vulnerability remains open, exploitation has already begun, and the fragility of legacy internet infrastructure means that similar incidents will recur.

Source: TechCrunch