{"slug": "php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet", "title": "PHP had a rough week for security, but the pain isn't over yet", "summary": "Security researchers at Calif used AI-assisted techniques to develop working exploits for a pair of PHP vulnerabilities, dubbed PHP2Shell, that had sat unfixed since 2024 and could have compromised more than two-thirds of the web, then disclosed the findings to The PHP Foundation, which coordinated patches released publicly on October 21, 2026. The disclosure embargo largely held with no initial mass-hacking wave, but Amazon Threat Intelligence reported PHP2Shell exploitation in its MadPot sensors before the embargo lifted, and millions of unpatched servers remain at risk. The episode highlights how AI is accelerating vulnerability discovery in aging open source software that The PHP Foundation, which maintains PHP, is underfunded to secure.", "body_md": "# PHP had a rough week for security, but the pain isn't over yet\n\nA pair of security vulnerabilities lurking in the PHP web programming language for more than a decade, dubbed PHP2Shell, threatened to take down vast swathes of the internet reliant on the software. Luckily, it didn't, and that's *probably* a good thing.\n\nIn case you missed it — [__my newsletter subscribers got a head start!__](https://this.weekinsecurity.com/this-week-in-security-october-25-2026-edition/) — PHP is software that powers some 70% of websites and web servers today. Security researchers found several bugs in PHP in 2024 that were concerning but couldn't be exploited, so they weren't fixed. But thanks to a new group of security researchers and a fresh sprinkling of AI, the [__team at Calif__](https://calif.io/php2shell/) earlier this year developed working exploits capable of taking out more than two-thirds of the web. *Not great!*\n\nThe researchers disclosed the new findings to [__The PHP Foundation__](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), which maintains the PHP software, sparking a months-long coordinated disclosure process to get patches to the biggest web hosts. The idea was to get fixes out to the companies that cover the most server space on the internet before patches went out publicly on October 21.\n\nThe good news is that the coordinated disclosure embargo largely held, and there was no initial wave of mass-hacks as some (including myself, admittedly) had expected.\n\nBut we're not out of the danger zone just yet.\n\nI chatted with [__Mikah Sargent on TWiT's Tech News Weekly__](https://twit.tv/shows/tech-news-weekly/episodes/461) about the PHP-ocalpyse, which still threatens millions of websites and servers that haven't been patched. These bugs also serve as a warning sign to the countless unknown and undiscovered bugs buried in aging software like PHP and others that have sat dormant for years, waiting for someone to pry them open in a way that allows hackers to break in.\n\nHere are some of my main takeaways from the conversation:\n\n- **Vulnerability coordinated disclosure worked.** Ensuring that patches are rolled out to the biggest internet giants while also not tipping details of the vulnerability to potential attackers is a tricky feat, but the circle of trust likely prevented a bunch of servers getting popped. That said, a*lot* of the internet is still vulnerable and patching will likely go on for some time, thanks to how decentralized and deeply embedded the software is.\n- **We got lucky. We might not be as much next time.** The two PHP bugs were not easy to exploit, which likely hindered the majority of attackers in developing working exploits for so long. Amazon said[__there was some exploitation__](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) before the embargo was lifted, suggesting that some highly skilled attackers somehow had a head start — either by stealing details of the bugs or by independently finding them.\n- **AI is undoubtedly changing hacking and cybersecurity.** Jason Koebler at 404 Media has[__an excellent blog post__](https://www.404media.co/php2shell-black-october-ai-is-changing-everything-about-hacking-no-one-knows-what-happens-next/) on how AI is rapidly speeding up the rate of vulnerability discoveries in both old software and new. The speed at which AI can find*and* exploit bugs in some of today's most popular software has taken plenty of folks in cybersecurity by surprise (and alarm).\n- **Open source software like PHP is massively underfunded.** Given how ubiquitous and widely used PHP is, thanks to it being free and open source, nonprofits like The PHP Foundation and the open source community more broadly are starved of cash and massively under-funded.[__Reuters ($)__](https://www.reuters.com/technology/php-foundation-under-funded-with-one-full-time-staff-member-director-says-2026-10-23/) spoke with the foundation recently, which says bug reports are going up but its contributors remain about the same, while big tech giants fail to pay or donate for their share of usage.\n\n*Thank you so much for reading ~this week in security~. If you like this article, please* *share a link* *on your social media! Reach out with any feedback or comments about this article:* *this@weekinsecurity.com**.*", "url": "https://wpnews.pro/news/php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet", "canonical_source": "https://this.weekinsecurity.com/php-had-a-rough-week-for-security-but-the-pain-isnt-over-yet/", "published_at": "2026-10-30 12:51:01+00:00", "updated_at": "2026-10-30 13:19:25.696431+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["PHP", "Calif", "The PHP Foundation", "Amazon", "AWS", "PHP2Shell", "Mikah Sargent", "Jason Koebler"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet", "markdown": "https://wpnews.pro/news/php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet.md", "text": "https://wpnews.pro/news/php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet.txt", "jsonld": "https://wpnews.pro/news/php-had-a-rough-week-for-security-but-the-pain-isn-t-over-yet.jsonld"}}