The most unsettling thing about PHP2Shell is not that PHP is old. It is that PHP is still everywhere.
Two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, reportedly created a path into unpatched PHP systems without a password or other credentials. The bugs were serious enough to trigger emergency patching across banks, retailers, hospitals, government agencies, online stores, and other services. Yet the wider internet appears to have avoided the mass compromise many defenders feared.
That near miss says something important about modern infrastructure. The web may look increasingly AI-native at the surface, but much of its underlying machinery still depends on decades-old software that is difficult to replace and impossible to ignore.
The web is only as resilient as its oldest shared layer
PHP is an open-source programming language used across websites and web applications. Around 70% of the web-facing internet relies on it, including systems associated with WordPress, Drupal, Joomla, and MediaWiki.
That percentage is the story. A vulnerability in a niche application can be contained. A vulnerability in a layer used by millions of sites becomes a coordination problem for the entire internet.
The reported bugs were especially dangerous because they enabled remote code execution and unauthenticated access. An attacker did not need a victim to click a link or open a file. An unpatched, internet-facing system could potentially be taken over remotely, allowing malware installation, data theft, or a persistent foothold.
The PHP Foundation released patches after a period of coordinated disclosure that gave major companies and web hosts time to prepare. That process appears to have helped prevent the worst outcome. But TechCrunch also reports that Amazon detected exploitation about a week before the public patches became available, while Cloudflare saw an exponential increase in exploitation attempts after disclosure. Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity.
The lesson is uncomfortable: coordinated disclosure can reduce the blast radius, but it cannot make a shared dependency disappear. It depends on maintainers, cloud providers, enterprise teams, small developers, and device makers acting quickly at the same time.
AI changes the discovery race, not the maintenance problem
Researchers at Calif reportedly found the vulnerabilities during a security audit and used AI as an aid during exploitation work. Their own explanation, as quoted by TechCrunch, stressed that the researchers’ existing knowledge of PHP and its exploitation history did most of the heavy lifting. No simple prompt discovered every weakness.
That distinction matters. AI may accelerate the search for flaws, but the hard problem remains the same after discovery: identifying every system that depends on the vulnerable component, communicating the risk, producing a safe patch, and getting thousands of unevenly resourced operators to install it.
It also exposes a structural weakness in open-source infrastructure. The tools that hold up large parts of the internet are often maintained by teams that cannot afford the security reviews and operational capacity expected of the companies building businesses on top of them.
PHP2Shell therefore looks less like an isolated PHP crisis than a warning about invisible dependencies. Newer memory-safe languages may reduce some classes of future vulnerabilities, but they do not remove the old layers still embedded in websites, routers, storage devices, firewalls, VPNs, developer tools, and enterprise systems.
For technology and marketing teams, the strategic consequence is simple: reliability is not only a product experience or uptime metric. It is also a dependency decision. The platforms and services brands use every day inherit risk from infrastructure most customers never see. The next major incident may not come from the newest AI product. It may come from the oldest layer everyone assumed was already understood.