--- title: The day after tomorrow: After PHP2Shell, it gets worse,... description: Two critical PHP remote code execution flaws, dubbed PHP2Shell, and a Brotli compression library flaw called Broccoli2Shell hit security teams hard in October.... canonical: https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The day after tomorrow: After PHP2Shell, it gets worse, then defenders win | daily.dev og:description: Two critical PHP remote code execution flaws, dubbed PHP2Shell, and a Brotli compression library flaw called Broccoli2Shell hit security teams hard in October.... og:url: https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq og:image: https://api.daily.dev/og/posts/UIBmGB7OQ.png og:image:alt: The day after tomorrow: After PHP2Shell, it gets worse, then defenders win og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The day after tomorrow: After PHP2Shell, it gets worse, then defenders win **[Aikido Security](https://daily.dev/sources/aikido-security)** · 5 min read · 0 upvotes · 0 comments ## Summary Two critical PHP remote code execution flaws, dubbed PHP2Shell, and a Brotli compression library flaw called Broccoli2Shell hit security teams hard in October. The underlying PHP bug surfaced in a 2024 audit but stayed unfixed until researchers showed it was exploitable, with AI turning the weird behavior into a proof of concept for RCE. Anthropic's Jason Clinton warns things get worse before better, predicting about 18 months to hold on, while Cloudflare's Matthew Prince expects a couple years of weekly 'sky is falling' moments. Aikido argues defenders can still win by combining strong architecture (invariants) with fast patching, and by knowing what software they run, since PHP turned up in container base images, CI images, hosting panels and vendor software. Fixes have been released for supported PHP versions and no mass compromise has been confirmed (yet). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is PHP2Shell and how was the vulnerability found? PHP2Shell refers to two critical remote code execution flaws in PHP. The underlying out-of-memory bug had appeared in a 2024 audit but went unfixed because nobody had demonstrated it was exploitable; researchers later showed AI could take that odd behavior and turn it into a full proof-of-concept for unauthenticated remote code execution. _Teams tracking PHP security fixes can follow emerging RCE disclosures like this one on daily.dev._ ### What is Broccoli2Shell or HTTP2Shell in the Brotli library? HTTP2Shell, jokingly nicknamed Broccoli2Shell, is a flaw discovered in the Brotli compression library around the same time as the PHP2Shell remote code execution bugs. It was part of a cluster of disclosures in October that security experts, including Anthropic's Deputy CISO Jason Clinton, had predicted months earlier as part of an AI-driven wave of vulnerability discoveries. _Developers watching for compression-library CVEs can keep tabs on fast-moving disclosures via daily.dev._ ### How should security teams respond to AI-discovered vulnerabilities in widely used software like PHP? Security teams should combine strong defensive architecture ('invariants' that hold regardless of attack speed) with fast patching, since good architecture limits damage but cannot remove an underlying flaw like one in PHP or Brotli. Aikido CEO Willem Delbare also stresses knowing exactly what software runs, including unexpected places like container base images, CI images and hosting panels, so teams can quickly tell if a disclosure affects them. _Engineers building a faster patch response process can track this kind of guidance on daily.dev._ ## Similar posts on daily.dev - [PHP2Shell Shows Why Security Cannot Stop at the Last Test](https://daily.dev/posts/php2shell-shows-why-security-cannot-stop-at-the-last-test-kibbq2lgf) · Medium · 0 upvotes · 0 comments - [PHP2Shell: Prepare for the Next Vulnerability](https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1) · Snyk · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The day after tomorrow: After PHP2Shell, it gets worse, then defenders win","url":"https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq"},"datePublished":"2026-10-29T14:29:21.935Z","dateModified":"2026-10-29T14:29:58.107Z","description":"Two critical PHP remote code execution flaws, dubbed PHP2Shell, and a Brotli compression library flaw called Broccoli2Shell hit security teams hard in October....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0436def3a0954172f07a9947bcab753?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0436def3a0954172f07a9947bcab753?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"The day after tomorrow: After PHP2Shell, it gets worse, then defenders win"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-day-after-tomorrow-after-php2shell-it-gets-worse-then-defenders-win-uibmgb7oq#faq","mainEntity":[{"@type":"Question","name":"What is PHP2Shell and how was the vulnerability found?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two critical remote code execution flaws in PHP. The underlying out-of-memory bug had appeared in a 2024 audit but went unfixed because nobody had demonstrated it was exploitable; researchers later showed AI could take that odd behavior and turn it into a full proof-of-concept for unauthenticated remote code execution. Teams tracking PHP security fixes can follow emerging RCE disclosures like this one on daily.dev."}},{"@type":"Question","name":"What is Broccoli2Shell or HTTP2Shell in the Brotli library?","acceptedAnswer":{"@type":"Answer","text":"HTTP2Shell, jokingly nicknamed Broccoli2Shell, is a flaw discovered in the Brotli compression library around the same time as the PHP2Shell remote code execution bugs. It was part of a cluster of disclosures in October that security experts, including Anthropic's Deputy CISO Jason Clinton, had predicted months earlier as part of an AI-driven wave of vulnerability discoveries. Developers watching for compression-library CVEs can keep tabs on fast-moving disclosures via daily.dev."}},{"@type":"Question","name":"How should security teams respond to AI-discovered vulnerabilities in widely used software like PHP?","acceptedAnswer":{"@type":"Answer","text":"Security teams should combine strong defensive architecture ('invariants' that hold regardless of attack speed) with fast patching, since good architecture limits damage but cannot remove an underlying flaw like one in PHP or Brotli. Aikido CEO Willem Delbare also stresses knowing exactly what software runs, including unexpected places like container base images, CI images and hosting panels, so teams can quickly tell if a disclosure affects them. Engineers building a faster patch response process can track this kind of guidance on daily.dev."}}]} ```