PHP2Shell is two critical bugs in PHP itself, rated 9.2, that can let attackers run code on PHP servers, and PHP runs roughly 70% of websites. We cover how the disclosure leaked a day early, why the NSA, CISA, the FBI and the UK's NCSC told organisations to take unpatched sites offline, and how 4chan, Wikimedia, DigiD and even BreachForums went dark. Then there's the fight over who found it between OpenAI, Wiz and Calif, plus the same-day Node.js, GitLab and Railway security news. 🔗 Relevant Links - PHP2Shell disclosure (Wiz Research): https://www.wiz.io/blog/php2shell-php-rce - PHP Foundation on the release, the leak and what's changing: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ - PHP security advisory: https://www.php.net/archive/2026.php - CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ❤️ More about us Radically better observability stack: https://betterstack.com/ Written tutorials: https://betterstack.com/community/ Example projects: https://github.com/BetterStackHQ 📱 Socials Twitter: https://twitter.com/betterstackhq Instagram: https://www.instagram.com/betterstackhq/ TikTok: https://www.tiktok.com/@betterstack LinkedIn: https://www.linkedin.com/company/betterstack 📌 Chapters: 0:00 - Intro 0:30 - What PHP2Shell is 1:29 - The leaked disclosure 2:24 - Websites go offline 3:11 - Even hackers went offline 3:39 - Was anyone hacked? 4:25 - Who found it? 5:40 - It won't be the last 5:51 - Railway breach 6:27 - Final thoughts
ADVERTISEMENT
I'm a dev with 30 years experience under my belt - and I have to give a high compliment to the level of information provided in just seven minutes here. I think you covered everything I needed to know with great detail. That you sourced all this information so swiftly, then drafted that into a script and presentation is incredible. Well done, and many thanks.
The bug that could hit 70% of hype videos.
One vulnerability affecting a huge chunk of the internet is a good reminder that cybersecurity isn't just about preventing attacks. It's about patching the boring stuff before it becomes a global problem.
Just saw Signal has a CVE too... so thats OpenCode, GitLab, Node, PHP, Railway, eMudhra and probably many more... this week.
GPT-5.6 Sol and Gemini 4 Argon finding this exploit feels like rival enemies uniting to defeat a bigger enemy in the movies
70% of websites does NOT equal 70% of the internet.
Naaah, I won't update. I'll just shut down the servers and quit! What's the point anymore...
Almost all of gov tech in Quebec shut down today
“I’m tired, boss.” Really gotta move to a good architecture that allows for rapid updates _alongside_ making sure you’re also on the latest version. I will absolutely say that at least for my use cases, containerization has been a life saver along with using LLMs to facilitate patching and bug fixing. Wild times!
Don't you just like these channels that go all apocalyptic on some piece of news that is already patched?
I was just transfered as a team lead for a team that has 7 of 14 repos in php, a lot of tech debt and no leadership Gonna be fun
it's scary that this was first possible and theorized about in 2004.
You are 100 percent correct, the hard part now is getting front of the disclosure, and as you say this is only going to get faster, the intelligence bar for hacking has been dramatically reduced and is going to get lower, it is a brave new world.
70%?
great report! one of the best ones I've seen so far. bless
This is where AI can be a good tool (for both sides). It still takes skill, deep understanding of the process, and the creativity to know what to do, and where to start. The average muppet with AI would use "make a hacking tool, like in Hackers, to let me get money!" and try the first spec of code it spits out.
I don't think PHP is the first or last in this new AI driven exploitosphere. Right now, I'm just patching containers, which thanks to the WordPress folks and the PHP team, has made this relatively easy with up to date images for the 3 mainstream PHP versions that are patched as barely a few hours after the CVE hit the internet. Suffice it to say, if your not using docker / containers and on latest, supported versions of your preferred language / framework, please consider doing so.
Irresponsible disclosure should be a crime at this point. It's becoming a nasty trend in 2026. Nobody believes the 'ups, it was a mistake' excuse anymore. It's on purpose. They want their 2 minutes of fame, if they cause realm harm, they don't care. Other security companies and researchers need to start shaming them in public. You can't trust a security vendor or researcher that can't even hold himself from posting something online.
this is what happens when you fire millions of engineers.
The Internet is not effected by this at all. 70 % of the Web is effected.