PHP sits underneath a huge part of the web. One estimate in the reports puts it at around 69 percent of websites whose server side language is known. This week two critical flaws were disclosed in it, named PHP2Shell, that could let an attacker run code on a server without even logging in. They reach back to PHP 5.4, which came out in 2012. Fixed versions were released on 21 October.
This one is close to home for me. I have PHP projects on my own GitHub from 2021.
Who Found Them
The reports say AI helped. A researcher at the security firm Calif used an OpenAI model during an OpenAI project called Patch the Planet, and researchers at Wiz found the flaws independently and used several AI tools along the way. The reports say the AI assisted, and they do not say how much of the work it did, so I will not pretend I know. One more detail stays with me. A PHP developer had reportedly noticed the error behind one of the flaws in an audit in 2024, and it was never fixed.
So some of this code sat there for more than a decade, and one of the holes was seen and left. What changed is that something can now read a whole codebase faster than any team ever could.
The Race Nobody Sees
The part I find more interesting than the bug is the timeline. Amazon's honeypot reportedly logged an exploit attempt on 17 October, four days before the fix was public. Details leaked on 20 October, a day early, so PHP had to release early. And because one vendor shipped patched software ahead of the announcement, attackers could compare the old code with the new and see exactly what had changed. Whether attacks were widespread by then is disputed. The security firm watchTowr said it saw them, and the US cyber agency CISA said it had not.
That is what I keep thinking about. The dangerous moment is not the bug. It is the gap between the first person who knows and the last server that is fixed. AI can shrink that gap for the people finding bugs, and for the people reading patches. It cannot shrink the time it takes a real company to update a real server.
The Old Box Again
Last time I wrote about a fridge controller that nobody updated. This is the same story with a bigger audience. PHP 7.4, 8.0 and 8.1 are no longer supported, so they got source patches only, with no ready built versions. Somebody has to build those by hand, and I would not bet on everybody doing it.
Reports also say PHP warned about a separate remote code execution issue two days later. PHP considers it unlikely, because it only affects unusual setups, and the advice is to switch off session upload progress until a normal fix arrives.
What I Think
I expect the conversation to move on within days, the way it did with the fridges, and that worries me more than the bug does. In my last piece I said that the speed that lets one person build a Photoshop clone is available to anyone looking for a weakness. This is what that sentence looks like in real life. This time the holes were found by researchers, and exploit attempts still showed up before the fix was public.
So I would update first and read the arguments afterwards. Check what version you run. Retire the ones nobody supports. And know what is on your servers before someone else finds out for you.
Some of this code is more than a decade old. The race to find the holes just got much faster. The race to fix them has to catch up.