--- title: We shouldn't be surprised about the PHPocalypse, as the... description: Three Register staffers discuss the PHP2Shell vulnerabilities, two memory safety bugs in PHP core affecting roughly 70 percent of websites going back to... canonical: https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue | daily.dev og:description: Three Register staffers discuss the PHP2Shell vulnerabilities, two memory safety bugs in PHP core affecting roughly 70 percent of websites going back to... og:url: https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg og:image: https://api.daily.dev/og/posts/bfAuLH0fg.png og:image:alt: We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue **[The Register](https://daily.dev/sources/theregister)** · 26 min read · 0 upvotes · 0 comments ## Summary Three Register staffers discuss the PHP2Shell vulnerabilities, two memory safety bugs in PHP core affecting roughly 70 percent of websites going back to version 5.4. AWS found exploitation attempts starting four days before patches shipped, but no successful attacks had been confirmed as of the recording. The emergency patch for the current version runs 13,000 lines of C. A third, harder-to-exploit bug was also disclosed, to be fixed in the next regular release. AI tools from Calif (working with OpenAI) and Google-owned Wiz found the flaws, which the companies say humans likely never would have discovered alone. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the PHP2Shell vulnerability and which PHP versions does it affect? PHP2Shell refers to two related memory safety vulnerabilities in PHP core that let attackers manipulate memory PHP trusts to achieve remote code execution, steal data, or deliver malware. They affect every PHP version released in roughly the last decade, going back to version 5.4, impacting an estimated 70 percent of all websites on the internet. _Teams patching PHP deployments can track fast-moving vulnerability coverage like this on daily.dev._ ### Has PHP2Shell been successfully exploited in the wild? As of the reporting, there were no confirmed successful attacks, despite exploitation attempts beginning at least four days before patches were released, according to AWS. Security researchers noted the attack chain is complex, which has slowed attackers, though a separate Vulncheck finding showed ASLR protections could be bypassed on x86 machines, so the risk remains active. _Developers monitoring an evolving exploit situation can follow updates like this on daily.dev._ ### How did AI help discover the PHP2Shell vulnerabilities? AI pen-testing startup Calif, part of OpenAI's partner program, used OpenAI models to find the flaws, while Google-owned Wiz independently discovered them too. Security researchers say these vulnerabilities, hidden for decades, likely would never have been found through human research alone given how complex and non-obvious the exploit path is. _Engineers weighing AI-assisted security tooling against traditional audits can keep up with cases like this on daily.dev._ ## Similar posts on daily.dev - [PHP rushes out emergency patches for two critical bugs AI found first](https://daily.dev/posts/php-rushes-out-emergency-patches-for-two-critical-bugs-ai-found-first-smuf7gcab) · The Next Web · 0 upvotes · 0 comments - [PHP2Shell Shows Why Security Cannot Stop at the Last Test](https://daily.dev/posts/php2shell-shows-why-security-cannot-stop-at-the-last-test-kibbq2lgf) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue","url":"https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg"},"datePublished":"2026-10-26T13:16:34.288Z","dateModified":"2026-10-26T13:40:36.580Z","description":"Three Register staffers discuss the PHP2Shell vulnerabilities, two memory safety bugs in PHP core affecting roughly 70 percent of websites going back to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1fc874078dc97bc7819571a980e4c915?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1fc874078dc97bc7819571a980e4c915?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT26M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/we-shouldn-t-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue-bfaulh0fg#faq","mainEntity":[{"@type":"Question","name":"What is the PHP2Shell vulnerability and which PHP versions does it affect?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two related memory safety vulnerabilities in PHP core that let attackers manipulate memory PHP trusts to achieve remote code execution, steal data, or deliver malware. They affect every PHP version released in roughly the last decade, going back to version 5.4, impacting an estimated 70 percent of all websites on the internet. Teams patching PHP deployments can track fast-moving vulnerability coverage like this on daily.dev."}},{"@type":"Question","name":"Has PHP2Shell been successfully exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"As of the reporting, there were no confirmed successful attacks, despite exploitation attempts beginning at least four days before patches were released, according to AWS. Security researchers noted the attack chain is complex, which has slowed attackers, though a separate Vulncheck finding showed ASLR protections could be bypassed on x86 machines, so the risk remains active. Developers monitoring an evolving exploit situation can follow updates like this on daily.dev."}},{"@type":"Question","name":"How did AI help discover the PHP2Shell vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"AI pen-testing startup Calif, part of OpenAI's partner program, used OpenAI models to find the flaws, while Google-owned Wiz independently discovered them too. Security researchers say these vulnerabilities, hidden for decades, likely would never have been found through human research alone given how complex and non-obvious the exploit path is. Engineers weighing AI-assisted security tooling against traditional audits can keep up with cases like this on daily.dev."}}]} ```