On Tuesday, the secret got out in the most ordinary way possible: someone uploaded a video. Calif, one of the security firms that had spent weeks quietly preparing a fix, accidentally posted a proof-of-concept video demonstrating an exploit chain. The clip came down, but it was too late. News of the flaw had already leaked in online forums. The PHP Foundation, the small nonprofit that maintains one of the internet’s oldest workhorse languages, threw out its schedule. The patches were fast-tracked and released 24 hours early, at 10 a.m. ET on Wednesday. Shortly before that, the NSA issued its warning.
The flaw is called PHP2Shell, and the name is the threat. A “shell” is the command line of a server, the place where whoever controls it can do anything. The bugs allow unauthenticated hackers to remotely execute code on any PHP server. No password, no phishing email, no careless employee needed. If you could reach the server, you could own it.
There was also no app to blame. This one lived in PHP itself, where several can be reached without the application itself doing anything wrong. When PHP runs out of memory mid-request, processing stops, but internal state is not always cleaned up consistently. The machine trips, and in the moment it falls, a door is left ajar. It’s believed to have been ajar since PHP 5.4.0, released in 2012.
Here is what PHP2Shell really tells us. For decades, a large part of internet security has rested on something nobody likes to say out loud: difficulty. Plenty of known weaknesses were left alone because exploiting them seemed too hard to be worth it. “Theoretically vulnerable, practically safe” is how much of the web has been run. That assumption just failed, in public, and it failed for defenders and attackers at the same moment. The leak is the drama. The bigger story is that difficulty no longer works as a defense.
Humans saw it first
The clearest evidence is a footnote in CNBC’s coverage. Two years ago, Mihail Kirov, then an engineer at Quarkslab, said he was part of a team that found a vulnerability with the same root cause as PHP2Shell. Skilled people looked straight at the crack and couldn’t pry it open. For two more years, difficulty was the only lock.
This year, someone opened it, with help. One of the researchers used OpenAI’s GPT-5.6 Sol model to assist with finding the vulnerability. The researchers at Wiz described the exploit chain as sitting “at the edge of what human researchers could practically achieve,” and said frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
The other side caught up within hours. After the leak, Matt Suiche said his team at Tolmo was able to code a working exploit in less than a day. The security firm Sansec expected mass attacks to start within 15 minutes of the release. Someone may have been ahead of them all: Amazon’s threat team identified a PHP2Shell exploitation attempt dating back to 17 October 2026, four days before public disclosure.
The servers nobody is watching
If difficulty was the lock, the question is who still depends on it. The answer is most of the vulnerable web. Qualys found 166 million PHP installations, 74% internet-facing. Of those with a known version, 109M (70%) run end-of-life or end-of-support branches outside upstream support.
Put plainly, most of the vulnerable machines will never get an official fix. The emergency patches cover PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the versions people are still maintaining. The rest are the internet’s attic: the dentist’s appointment page built in 2014, the town council portal, the school district’s forms, the forum someone set up and forgot. Their owners never patched because nothing ever happened. Nothing happened because breaking in was too hard. That excuse is gone.
Part of the internet did get lucky. Cloudflare, brought into the coordinated effort early, deployed WAF protections about 9 hours ahead of public disclosure, so sites behind its network had a shield before their owners knew there was a threat. It’s worth noticing what that luck depended on: a handful of large companies, an AI lab and a volunteer-led foundation all doing the right thing within the same nine-hour window.
What follows
If difficulty is no longer a defense, several things we’ve tolerated stop being tolerable.
The first is the patch calendar. Coordinated disclosure assumes defenders have weeks, and attackers need longer than that to build exploits. PHP2Shell went from leak to working exploit in under a day, so the quiet period now has to be treated as already broken.
The second is end-of-life software. Running an unsupported PHP version used to be technical debt, embarrassing but survivable. Now it means running a server whose remaining protection has disappeared. Migrating is no longer housekeeping. It’s the fix.
The third is who does the finding. The same models that helped Wiz, OpenAI and Calif break a decade-old lock exist, in some form, for people who won’t announce what they find. The only workable answer is for defenders to use the same tools faster, and to scan their own code before someone else does. That’s a much bigger job than one foundation shipping one patch, and the institutions that maintain the web’s foundations are underfunded for it.
PHP2Shell went about as well as these things can. The good guys found it first, a fix was nearly ready, and a major provider shielded millions of sites in advance. It still leaked, attackers still moved within hours, and tens of millions of servers are still exposed with no patch coming. That was the best case. The rest of the web’s old locks are still waiting to be tested.