PHP2Shell: AI is Not the Story Here
The Last Day of Pompeii, painting by Karl Bryullov (1830-1833)
I wrote a note on the German part of the blog yesterday about a warning of two critical flaws in the web application programming language PHP. I wrote this note because the warning and upcoming patch forced Joy Club, Germany’s biggest community for casual sex encounters, to take their site offline. The two security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have collectively been named PHP2Shell and they are pretty bad.
The Popularity of PHP
One big factor is the prevalence of PHP itself. It has been estimated that about 70% of the web runs on it. This is because this web scripting language was hugely popular when many open source projects were developed that later on became hugely prevalent. Among those are popular content management systems like WordPress, Drupal, Joomla and MediaWiki (which runs Wikipedia among other things). But many other custom web applications and websites are also written in PHP. Including many websites that have no need for visitors to contribute content to the site and could be completely static, which is a huge problem.
I used to be part of this problem. For many years, many of my websites, including this blog, ran on PHP. First on WordPress and then on Drupal. These sites used PHP mostly to enable readers to leave comments and to power the backend where I, as the author, would write the posts. The rest of the website, which could have well been static HTML/CSS with JavaScript taken from a flat file, was nonetheless rendered dynamically on every user view from an SQL database. This makes a website much more attackable than the aforementioned static alternative.
I later switched my personal blog to Ghost, which is a more modern technology that exchanges PHP for server-side JavaScript to power comments and an admin interface and which eliminates the database in favour of flat file data storage. While still dynamically generating pages on the server with every user request, it is much more stable and secure than something running a huge stack of PHP code. A while later I then finally switched to a static site, which I generated once with Hugo and then uploaded to a server. These days, I run my own hacked-together system that doesn’t even use JavaScript on the client side. I don’t want to be part of the problem anymore.
The Problem with PHP
Now, the issue with something like PHP is that it can be attacked in a myriad of ways. Not only can your specific application and its plugins be attacked, if the worst case scenario happens, there is a flaw in the framework, or even the programming language you are using, itself. PHP2Shell is such a worst case scenario.
The two vulnerabilities that have now been publicly disclosed, allow an attacker to target a PHP-powered application over the web by sending specific HTTP requests to the webserver that serves the PHP application. These requests need to be carefully crafted, and exploitation depends on how PHP is configured on the server, but if the exploit works, the requests will force the PHP runtime to run out of memory and execute arbitrary code the attacker sends within the session. All of this happens in the PHP runtime, before any application code is executed. This means it doesn’t matter what your web application looks like, you are vulnerable simply because you use PHP.
Arbitrary code execution is another worst case scenario in a hack like this and means the attacker could take over your whole web application, possibly even the whole server it runs on. This explains why not only Joy Club, but also many government websites were shut down yesterday. That was probably a smart move. It kind of shows you that the people running these websites weren’t prepared for an attack, you could argue they didn’t really know what they were doing, but more on that later. They probably reacted correctly in the moment — unprepared as they were.
AI Stupidity Once Again
Pretty much every headline about this story mentions that these flaws were found by using AI technology. Many outlets have made that the whole story. And, of course, Wiz — the security company that discovered and publicised the vulnerabilities — made a big deal out of having found the flaws with “frontier AI models”. This is happening because these people know how to get publicity and because journalists are too dumb to understand what the actual issue is here.
It doesn’t matter at all how these vulnerabilities were found. What people call “AI” is just another way of algorithmically looking at data to find this shit. Before that, it was Shodan. Now it’s LLMs. When Shodan came out, everybody was seeing the world burn because of it. It was going to be the end for all software on the web. Now it’s AI. This is stupid. When will people wake up to understand what the real problem is?
The actual problem is that software is shit. Literally nobody, except maybe NASA, writes software that is meant to be secure before it is anything else. Yes, that is expensive and, yes, that slows down “innovation” (whatever that actually is), but it is also the only way to prevent shit like PHP2Shell from happening.
The scary thing about these vulnerabilities is not that AI found it. That’s actually good. It’s good that these vulnerabilities were found! The really scary thing is that these severe vulnerabilities were present in the core PHP codebase for decades before being found!
The public, because of stupid colleagues of mine in the press, has a seriously upside down understanding of these kinds of things! This even effects experts in the field in many cases. They think that it’s bad when security vulnerabilities are disclosed, because there’s panic and everyone has to scramble to fix things. No, that’s good! What is bad is the security vulnerabilities that haven’t been found, that you don’t know about. Just because you don’t know about them doesn’t mean they don’t exist.
I know this is counterintuitive. But these PHP vulnerabilities were probably exploited for years (maybe even decades) by actual bad guys. Not the script kiddies and petty criminals that are attacking sites right now, but by organised crime and — much worse — intelligence services around the globe. The people that spend serious money on finding flaws like this and keep them close to their chest. They have found stuff like this for decades without the use of “frontier AI models” and these days their AI models are probably years ahead of the “frontier”.
Instead of homing in on AI, the press should understand what the actual problem is: our software is shit, has always been shit and — if we keep going like this with vibe coding and using AI instead of our brains — will be even more shit in the future. And we are basing more crucial elements of our life on this shit every single day. That is the real story. That’s what’s actually scary.
The Lesson Here
The lesson here is don’t use PHP. At least not for a simple website where you put information into a system to display it to the public. Use a static site for that, for fuck’s sake. And get rid of SQL database if you can. Please.
If you have a need for mild user interaction, use a modern web application framework; most of them use JavaScript these days. Something like NodeJS or whatever. I can’t believe I’m defending JavaScript here, but generally, with publicly-exposed stuff like this, you want to use the least powerful language and framework you can. PHP is just too powerful. It’s from an older, much more naïve era of web development where people were drunk on features and didn’t realise they were going to get attacked — with every single feature being made a weapon in the arsenal of the attacker.
And if you need hardcore business logic exposed to the public internet, and you absolutely must use something like PHP, please have a Plan B. Either have a second server infrastructure that you can expose to attack while you patch your main systems, or better, have a static version of your site that has user interaction disabled but still provides all other information to visitors, that you can put up while you fix your dynamic application. Have a system in place that detects if your severs have been tampered with, independent of what they are actually running.
I feel the main lesson here is one that I have been talking about for years: way less websites than people realise need to be dynamic. Most of the government sites that were taken down as a precaution in this case were like 99% static information and 1% user interaction. Why not split this into two infrastructures? One completely static that basically can’t be attacked short of DDoS or attacks on the actual hosting, and another system that implements the business logic for user interaction and will always be treated as a security risk and is also taken down in a case like PHP2Shell without compromising 99% of the overall web presence.
Of course, I know why people aren’t doing this. It’s too complicated and too expensive. You’d have to retrain the people who maintain it and, worse, those who put the content up. So what do we do? We stick with shitty software and when something inevitably goes wrong, we blame the evil hackers. And these days, we just blame AI. Because that’s what AI is really for: to absolve people of any responsibility.
Here’s the Real Brainfuck
Have any of the people who have been scrambling since yesterday to patch their PHP installations actually paused to consider the really scary possibilities here? That their whole web presence might have been hacked and owned by someone who knew about these vulnerabilities decades ago? Some actually malicious entity who keeps things like this secret and files them in their hacker arsenal to do bad things with them for decades before the “frontier AI models” catch up. Now there’s a scary thought!
Update // 18:39 CEST:
Further reading: