We can now find flaws faster than anyone can fix them

On October 21, 2026, the PHP project shipped an emergency security release outside its normal schedule. Two flaws in PHP’s engine - quickly nicknamed php2shell - were rated 9.2 out of 10, and they affect every version of PHP released since 2012. PHP runs roughly seven out of ten websites on the internet.