PHP2Shell Is About to Turn the Internet Into a Group Project Nobody Finished
PHP has been holding up roughly 70% of the internet like that one friend who keeps promising they’ll “get their life together” while living in a basement full of dusty WordPress plugins and a half-eaten sandwich from 2019. This week it decided to announce two critical remote code execution bugs (CVE-2026-109618 and CVE-2026-109619, lovingly nicknamed PHP2Shell) that let attackers run code before your actual website even wakes up and notices. No login required. Just a carefully crafted request and suddenly someone’s got a shell on the server while your shopping cart is still calculating shipping on a pair of socks.
The bugs live in memory management and error handling—the parts of PHP that every single request touches—so this isn’t some obscure plugin edge case. It’s the foundation. Researchers found them with AI help (GPT-5.6 Sol, apparently, which is either impressive or proof the robots are already better at finding ways to set the house on fire than we are). Patches dropped for the still-supported versions on October 21. Everything older is basically told to go stand in the corner and hope for the best, with a few half-measures that the PHP people themselves say don’t actually make you safe.
Is this the end of the internet? No. Is it going to be extremely funny for about 48 hours while half the web frantically upgrades and the other half discovers their shared hosting panel still thinks it’s 2017? Absolutely. The real nothing-burger is that we’ve spent years arguing about whether PHP is dead while it quietly kept running the grocery store websites, the school district forms, and half of ecommerce, and now we’re all acting shocked that the old infrastructure has the structural integrity of a wet cardboard box. Patch your stuff. Or don’t. I’m sure the AI that found this will write a very polite note when it starts redecorating your database.
Verdict: DEPENDS
Early hype check on a vulnerability, not a product. It’s worth treating seriously (and patching) if you run PHP. The internet-wide panic is overblown for anyone already on supported versions. For everyone else, this is just the latest reminder that the stack holding up a lot of the web is still the same one we keep saying is fine until it isn’t.