PHP-ocalypse: How two critical web bugs almost broke the internet

On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them.

The bugs are dubbed PHP2Shell, officially designated as CVE-2026-109618 and CVE-2026-109619. In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data.

As situations go, this was a pretty sizable one, forcing millions of people around the world to scramble to patch their systems before malicious hackers could abuse them.

The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs, which when installed prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching.

Thanks to weeks of backroom chatter and careful coordination across the industry, the world — so far — broadly avoided mass internet exploitation. From Wednesday, governments began urging citizens and companies with websites to take action to mitigate the risks on their ends. A wide range of industries shuttered their websites and pulled services offline to patch their systems. Banks, retailers, gaming sites, online stores, hospitals, and some government agencies took down their servers to prevent attacks.

But security researchers are warning that the situation isn’t over yet, and that a large number of systems around the world remain unpatched and vulnerable to hacks and data theft. 

This is also unlikely to be the last major internet software scare, with some expecting the advent of AI to rapidly uncover as-yet-undiscovered vulnerabilities that are waiting to be found and abused.

What happened?

Security researchers at Calif found two bugs in PHP, a programming language widely used around the world for building websites and web apps, both on the internet and hosted locally on company networks, like intranets and internal sites.

PHP is open-source, meaning it’s free and available to be used by anyone for almost any reason. As such, it’s become one of the most popular and broadly used web programming languages on the web today.

The two bugs were first discovered in 2024 but weren’t considered exploitable at the time, and weren’t patched. Security researchers recently found a way to exploit them, prompting them to alert the makers of the software to get them fixed. 

Calif alerted the PHP Foundation, which began a period of fixing the bugs and coordinated disclosure. The foundation did this by offering the information and patches about the security issues under a tightly guarded embargo — essentially held confidentially until a specific deadline — to give big companies an opportunity to get ahead of installing the fixes.

Why are the bugs so serious?

PHP2Shell is pretty serious because it can be abused remotely over the internet and without the victim having to click on a link or open a file. This is known as remote code execution, and it’s one of the more damaging kinds of bugs to exploit because they can grant a hacker anywhere in the world effectively full control over an affected and unpatched system.

Worse, these specific PHP bugs make it possible to break into any unpatched system on the internet without needing a password or any other credential over the internet, known as unauthenticated access. 

This would allow a malicious hacker to then plant malware on the computer, such as to steal data or simply to maintain a long-term foothold that they can return to later.

Why was 70% of the web affected?

The bugs are particularly risky because PHP is wildly popular software, in part because it’s free and relatively easy to use, but also because it’s been around for decades. Around 70% of the web-facing internet relies on PHP, though its usage has been slowly declining over the years in favor of newer, more secure programming languages.

Given its popularity, some of the world’s most popular websites are run on web software that rely on PHP, such as WordPress (which hosts TechCrunch!), as well as Drupal, Joomla, and MediaWiki, which powers online encyclopedia giant Wikipedia.

PHP is just one of many aging but functional technologies that have survived waves of the internet and generations that are now so ubiquitous, they’re akin to the glue that holds much of the internet together. Oftentimes these tools are developed by open source maintainers, who are not paid for the work that they do, and as such cannot afford third-party security reviews — but are still widely relied on by companies who do not contribute financially to the projects.

Was AI used to discover the bugs?

Security researchers at Calif were credited with discovering the bugs earlier this year as part of a security audit of PHP’s code. Calif was participating in the Hack the Planet initiative by AI model maker OpenAI and cloud security giant Wiz, which subsequently verified the proof-of-concept exploits that Calif made.

In Calif’s write-up (featuring comics — it’s great, check it out), the researchers explained that AI was used in assistance with exploiting the bug, but that the bulk of the work relied on knowledge that the researchers already had, and that they knew PHP’s codebase and exploitation history well.

“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,”wrote Calif.

Why were the bugs exploited ahead of disclosure?

Despite efforts to keep details of the bugs under wraps until Wednesday, it does appear that there was some PHP2Shell exploitation prior to the release of patches.

Amazon, which has enormous visibility into online threats due to its size and scale, said in a blog post that it detected exploitation of PHP2Shell about a week before the PHP patches were available, suggesting that someone, somewhere, knew how to exploit the bugs before their details were broadly available. Amazon said it wasn’t clear how the hacker learned of the vulnerabilities, but that defenders should look for evidence of exploitation as early as October 17.

There are a few theories as to what happened. Once a bug is patched, the details of the patch can become immediately apparent, especially if the code — like in PHP’s case — is open source, making it public and inspectable. Exploiting the bugs might not be easy, but knowing where the bug is and how it was fixed can allow malicious hackers to understand where to target and how to develop their exploits.

It’s possible that there was a leak or a breakdown in communication somewhere during the embargo. The open source community is enormous and controlling information in this fashion relies on good-faith. 

It’s also possible that hackers discovered the bugs ahead of time, either independently or through espionage.

The PHP Foundation blamed one company for pushing the patches live hours before the embargo period was up, which could have given some attackers a headstart if they obtained details of the patch before others. But this doesn’t account for the week-long activity detected by Amazon.

Researchers say that bugs require a lot of work to become exploitable and weaponizing the bug has been a challenge — but not impossible — which explains why we haven’t seen a scale of mass-exploitation just yet.

But as of late Friday, there are now confirmed compromises and post-exploit activity related to the PHP bug, according to security giants Palo Alto Networks and Trail of Bits. That means the bug was detected being abused to hack in and actively do malicious activity on an as-yet-unknown target.

Large parts of the internet shut down, but are returning. Did we dodge the worst of it?

It’s still early days but it’s an encouraging sign that there haven’t been any signs of mass-exploitation — but we’re not out of the danger-zone just yet.

Matthew Prince, the chief executive of network security and monitoring giant Cloudflare, which also has telemetry into a vast portion of the internet, said this week that it’s seen an exponential number of attempts to exploit the bugs following their disclosure. This gives some perspective as to how quickly malicious actors are seeking to abuse the flaws for their own gains.

PHP isn’t just found on web servers, but also used in developer tools, command line and terminal packages, and other software components used by routers, storage devices, and enterprise security devices, like firewalls and VPNs. 

We should expect to see exploitation of PHP2Shell down the line as smaller IT teams and sole developers may be slower to update. There will also be a period in which various companies that rely on and integrate PHP into their own products and software, which will also need updating.

As more devices and systems get updated, the attack surface will reduce in time. But the ripple effects of these bugs could still be felt for years to come, particularly in legacy systems that have no means to be updated.

Will this happen again?

This was one of those rare internet-stopping days I’ve seen during my time as a security reporter. In 2016, a massive botnet flooded internet registry Dyn with junk traffic causing much of the web’s top services to crawl to a halt. In 2017, North Korea used leaked U.S. government hacking tools to infect the U.K.’s health system with ransomware. And in 2024, a faulty CrowdStrike update sparked a massive global outage causing most of the world’s Windows computers to crash at once.

By all accounts with PHP2Shell, the internet escaped what could have otherwise been an extremely painful and damaging day. But it’s unlikely to be the last major incident to hit the web, and this may be the first in a trend of incidents that exploit weaknesses in legacy technology. Much of this is due to inherent flaws in aging but omnipresent software that haven’t yet been discovered, coupled with AI tools that are making it easier to find flaws.

PHP, much like other web programming languages and technologies from decades ago, are “memory unsafe,” which means they can be attacked through an entire class of vulnerabilities that can force the software to leak or spill sensitive data from the software’s memory storage. The National Security Agency says around 75% of all actively exploited vulnerabilities abuse memory-related flaws, which is to say, hackers use them a lot.

This has helped to prompt a move to using memory-safe languages, like Python, Rust, and Swift, which can’t be abused in the same way that memory vulnerabilities can be. As such, these languages make them broadly immune to a broad swath of vulnerabilities that still affect their predecessors.

But that still leaves an entire chunk of the internet running a bunch of technologies, like PHP, media and video codecs, compression libraries, and other software from decades ago — which, when they break, will have massive implications for the rest of the web.