PHP2Shell Just Proved the Web’s Foundation Is Cracked. The Cleanup Will Take Months.

(SeaPRwire) –

By: Lucas Caldwell

The internet just got a new nightmare, and its name is PHP2Shell. This is not some obscure WordPress plugin bug. This is the language itself, the thing running roughly 70 percent of the web. Wikipedia, WordPress, government portals, all of it sitting on a decade of vulnerable versions. The disclosure hit Wednesday, and the panic was instant. Cloudflare watched exploit attempts go from thousands to millions in hours. Governments yanked sites offline. The Finnish government, the BBC, Wikimedia, Edinburgh council, all down. This is the kind of event that separates people who understand infrastructure from people who just build marketing pages.

Here are the facts, stripped of spin. Researchers at Wiz and a shop called Calif found two vulnerabilities inside PHP itself. Versions released over the last decade are exposed. Ryan Austin, a Calif researcher, calls it the most serious flaw he has ever found. The kicker? AI tools found these bugs. Wiz says these are the most severe vulnerabilities ever detected by AI. OpenAI, whose tech was used, calls it one of the most impactful security issues in recent memory. Salil Kanhere from UNSW Sydney makes the sharpest point. The bugs are not new. What changed is the ability to find them.

Then the timeline gets ugly. Details leaked online this week, which forced the PHP Foundation to rush out its announcement. Cloudflare CEO Matthew Prince logged the surge. Thousands of exploit attempts in the ten hours before disclosure. Tens of thousands within 45 minutes. Hundreds of thousands within two hours. Millions since. Amazon says it got hit with multiple attempts days before the disclosure, though its sites kept running. The PHP Foundation shipped patches Wednesday and told everyone to update. Updating WordPress or its plugins changes nothing. The flaw sits in PHP itself. The NSA told organizations to take systems offline if they cannot patch. The UK’s NCSC echoed that and told firms to check for backdoors.

Now think about scale. PHP runs somewhere around 70 percent of the web. That is not a niche. That is the substrate of the internet. The real problem is that most large companies do not know where PHP runs inside their own networks. John Gallagher of Viakoo says the window of vulnerability could last several months. Several months. In that time, this becomes a game of hide and seek. Attackers scan for unpatched servers. Defenders scramble to inventory their own estates. The asymmetry is brutal. Offense only needs one open door. Defense needs perfect knowledge of every server, every legacy app, every forgotten admin panel.

Then there is the cost of doing nothing. Governments and companies pulled pages worldwide. The Finnish government, Edinburgh council, the BBC, the Dutch cyber-security agency, the University of Geneva, several Scottish councils and health boards. Wikimedia pulled systems. Japan’s Prime Minister Sanae Takaichi told citizens to check whether public websites run PHP. That is a prime minister talking about a programming language. Unplanned outages at large companies can run up to 15,000 dollars a minute. Jason Soroko of Sectigo says patch and then replace server passwords and certificates. The cleanup is not a one-click affair. It is forensic work.

The US cybersecurity agency says it has not identified any successful attacks linked to the flaw, but Salil Kanhere warns that more attempts are almost certain in the coming weeks now that the technical details are public, and those weeks will decide whether PHP2Shell becomes a quiet footnote in security history or the opening chapter of a mass server takeover that finally proves the web’s silent majority has been running on borrowed time, with most site owners still unable to say where their PHP even lives.

Author bio: Lucas Caldwell, a tech opinion leader with millions of followers on X/Twitter, known for cutting through vendor spin and dissecting infrastructure failures with brutal clarity.