PHP2Shell: The bug that hid for ten years

Tech abbreviations

What does each one stand for, and what is it used for?

PHP · HTML · CSS · SQL

API · URL · HTTPS · IDE

CMS · OS · VPN · DDoS

JSON · LLM · CVE · RCE

PICTURE

(you add this)

TEACHER'S REFERENCE · SKIP OR DELETE BEFORE CLASS

Tech abbreviations

PHP PHP: Hypertext Preprocessor (originally Personal Home Page) — a server-side language that builds web pages each time someone visits

HTML HyperText Markup Language — defines the structure and content of web pages

CSS Cascading Style Sheets — controls how web pages look

SQL Structured Query Language — storing, searching and managing data in databases

API Application Programming Interface — lets one program request data or services from another

URL Uniform Resource Locator — a web address

HTTPS HyperText Transfer Protocol Secure — the encrypted connection between a browser and a website

IDE Integrated Development Environment — software for writing and testing code, such as VS Code

CMS Content Management System — a platform for building and running websites, such as WordPress or Drupal

OS Operating System — Windows, macOS, Linux, Android and so on

VPN Virtual Private Network — an encrypted tunnel for your internet traffic

DDoS Distributed Denial of Service — flooding a site with traffic from many machines to knock it offline

JSON JavaScript Object Notation — a lightweight format for exchanging data

LLM Large Language Model — the type of AI behind chatbots like ChatGPT or Claude

CVE Common Vulnerabilities and Exposures — the official ID number given to a publicly known security flaw

RCE Remote Code Execution — when an attacker can make a computer run their code from far away

Why has PHP been in the news recently?

The bug that hid for ten years

On 20 October 2026, the people who look after PHP announced two critical security flaws. PHP is one of the oldest and most widely used programming languages on the internet. It runs on the servers behind roughly 70% of the world's websites, including sites built with popular platforms such as WordPress and Drupal, so the news travelled fast.

The two flaws, nicknamed “PHP2Shell”, were dangerous because they allowed remote code execution.

In plain English, an attacker anywhere in the world could send instructions to a vulnerable server and make it obey them, with no password and no account needed. From there, they could steal data, install malware or take a website down.

What made this bigger than a normal security alert was who, or what, found the problem. The flaws had been sitting unnoticed in PHP's code for more than a decade.

Then, over a few weeks in August, researchers at OpenAI and two security companies, Wiz (owned by Google) and Calif, used advanced AI models to examine the code. The AI found weaknesses that human reviewers had missed for years.

The researchers reported the problems privately to the PHP Foundation. This non-profit organisation maintains the language together with volunteers.

Wiz described the flaws as among the most severe ever found in PHP, and possibly in the history of software. OpenAI said that, as far as it knew, AI had found them before criminals did.

Not everyone found that reassuring. If AI can find hidden bugs for the good guys, it can find them for the bad guys too. The PHP Foundation itself warned that AI will make weaknesses like these much easier to discover.

Discussion

Are you surprised that a flaw could stay hidden for over ten years in code used by most of the internet? How could that happen?

Were you affected at all by this news?

AI found the flaws first. Is this story mainly good news or bad news?

OpenAI was quick to publicise its role in the discovery. Is that responsible communication, or marketing?

Would you trust an AI to check the security of something important to you, such as your bank's app?

Patch now, or switch off?

Normally, a serious bug is handled quietly. Researchers report it privately, a fix is prepared and tested, and only then are the details made public. This time, that plan fell apart. Before the fix was ready, a working demonstration of the attack was posted anonymously online. Security companies reported that criminals were already trying to use the flaws, in some cases even before the official announcement.

The PHP team responded by releasing its fix on 21 October, a day earlier than planned.

Some hosting companies had installed it before it was public, because major Linux distributions and long-term support providers received the patch in advance.

For everyone else, the advice from governments was unusually blunt. The US National Security Agency, the EU's cyber emergency team CERT-EU and the UK's National Cyber Security Centre all told organisations to update immediately. If they couldn't, they should take their systems offline. Many did exactly that.

Finland temporarily shut down its government's public web services. In the Netherlands, the national cyber-security agency's website and the parliament's website went offline. Sites in Belgium, the Czech Republic, Germany, France and Denmark followed, and Japan's prime minister posted a warning on social media.

Why the panic? The time between a fix being published and criminals exploiting it has shrunk dramatically.

Attackers can study a patch to work out exactly where the weakness is. AI tools now help them do this in hours rather than weeks, so every unpatched server becomes a target.

Experts say the hardest part is not installing the update. It is knowing where PHP is running in the first place. Large organisations may have forgotten servers, old projects and test sites. Small businesses on shared hosting depend entirely on their provider to act.

Your call

You are responsible for these websites. The patch is out, but your team needs 48 hours to install and test it. Do you keep the site running or take it offline?

• a city council's website for paying local taxes

• a hospital's online appointment system

• a small online shop that makes most of its sales this week

• a news website during a major breaking story

Discussion

Was shutting down government websites sensible caution or an overreaction?

Publishing a fix also shows criminals where the weakness is. Should details be kept secret for longer?

Assess the following logic:

• AI has found a weakness in PHP

• There are likely weaknesses in other places

• Criminals could use AI to exploit these weaknesses

Predictions: AI and the security of other systems

1

Power grids:

2

Cars:

By 2035, AI will constantly scan the software that controls electricity networks. Blackouts caused by hackers will become rarer, but the ones that do happen will be bigger.

Cars will receive security updates as often as phones. A car that hasn't been updated may not legally be allowed on the road.

3

Medical devices:

4

Banking:

Before a pacemaker or insulin pump can be sold, regulators will require it to survive weeks of attacks by AI.

Attacking AIs and defending AIs will fight each other inside bank systems in real time, far too fast for any human to follow.

5

Old infrastructure:

AI will uncover thousands of forgotten flaws in decades-old systems that run water treatment plants and railways. There will be too many to fix, and some systems will have to be rebuilt from scratch.

6

Elections:

7

Smart homes:

Every country's voting software will have to be checked by AI from several independent organisations before results can be trusted.

AI will expose so many weaknesses in cheap cameras, doorbells and fridges that devices without guaranteed security updates will be banned from sale.

8

Open source:

9

Satellites:

Governments will treat key open-source code like roads and bridges, paying for regular AI security inspections out of public money.

Hacking satellites will become a common tactic in conflicts, and AI defence systems will be launched into orbit to protect them.

10

Jobs:

Almost all security bugs will be found and fixed by AI before a human ever sees them. Human security experts will mainly decide what to fix first and who to blame.