On October 21, PHP shipped emergency patches for php2shell, a pair of memory bugs that can let an attacker run code on servers running almost any version of PHP released since 2012. PHP runs about 70 percent of the web, including WordPress, Drupal, and MediaWiki. The bugs were found by researchers at Wiz, OpenAI, Calif.io, and Quarkslab, using frontier AI models to build an exploit that Wiz said sat at "the edge of what human researchers could practically achieve." The fixes depended heavily on the PHP Foundation, which received $730,534 in donations last year and spent $139,000 more than it took in. That gap is the problem. The industry now has well-funded, AI-assisted ways to find flaws in the code the internet runs on. The budget for fixing them hasn't grown. Finding bugs gets cheaper every month, and fixing them doesn't.
On October 21, PHP shipped emergency patches for php2shell, a pair of memory bugs that can let an attacker run code on servers running almost any version of PHP released since 2012. PHP runs about 70 percent of the web, including WordPress, Drupal, and MediaWiki.
The bugs were found by researchers at Wiz, OpenAI, Calif.io, and Quarkslab, using frontier AI models to build an exploit that Wiz said sat at "the edge of what human researchers could practically achieve." The fixes depended heavily on the PHP Foundation, which received $730,534 in donations last year and spent $139,000 more than it took in.
That gap is the problem. The industry now has well-funded, AI-assisted ways to find flaws in the code the internet runs on. The budget for fixing them hasn't grown. Finding bugs gets cheaper every month, and fixing them doesn't.
I first saw signs of php2shell in the Drupal security Slack, before the official advisory. Details had leaked ahead of the planned disclosure, and within hours my team was on an incident bridge, inventorying every PHP runtime we owned. [Add one concrete detail: how many hosts, how many hours, what broke.]
The two bugs, CVE-2026-109618 and CVE-2026-109619, are in the PHP engine itself, not in any application or plugin. Under the right conditions, an out-of-memory error or a fatal error during a request leaves PHP holding memory it has already freed. An attacker can use that to read secrets from other requests or run code on the server. Every PHP release back to 5.4 is affected by at least one of the two. PHP runs roughly 70 percent of websites, including WordPress, Drupal, and MediaWiki.
The people who found these bugs were well funded. Researchers at Wiz, Calif.io, OpenAI, and Quarkslab used frontier AI models to build an exploit chain that Wiz described as being at "the edge of what human researchers could practically achieve." Cloudflare had firewall rules live hours before disclosure. That work was real and it protected a lot of people.
The people who had to fix the bugs are a different story.
The team behind the patch
Much of the work on PHP's core is done by developers contracted by the PHP Foundation. At the start of 2026 that was 11 people, part-time and full-time. In 2025 they wrote about 42 percent of all commits to PHP's core. The foundation received $730,534 in donations that year and spent $784,376, running a deficit of about $139,000 to keep its developers paid. The number of sponsors fell from the year before.
So the language under most of the web is maintained by a team with a budget smaller than many companies spend on a single enterprise software contract. The foundation's biggest backers (JetBrains, Automattic, GoDaddy, and Germany's Sovereign Tech Agency) deserve credit. But 536 sponsors is a small number next to the millions of businesses that run PHP in production.
Finding bugs is getting cheaper. Fixing them isn't.
This is what php2shell changes. These flaws had been in PHP for over a decade. What made them exploitable was AI-assisted research, and those tools are available to attackers too. Discovery is getting cheaper fast. The work of fixing a memory-safety bug in a 30-year-old C codebase, testing it across every supported version, and shipping it on a coordinated date is not.
Recommended by LinkedIn
Bug bounties and security research pay for discovery. Almost nothing pays for the slow work that keeps bugs from shipping in the first place: refactoring old error-handling paths, fuzzing, code review, release management. If the cost of finding bugs keeps falling while maintenance budgets stay flat, php2shell won't be the last incident like this.
Why companies don't pay, even when engineers want them to
I've tried to get money to open source projects from inside a large company. I can get a five-figure cloud bill approved in an afternoon. A $50,000 check to a foundation with no SLA, no indemnification, and no sales rep has no path through procurement at all. Nobody refuses outright; there's simply no process for it.
The XZ Utils backdoor in 2024 showed what happens when that gap goes unaddressed: a single overworked maintainer was socially engineered over two years into handing commit access to an attacker.
What would actually help
Use a vendor of record. Open Source Collective (which already hosts the PHP Foundation's finances) and services like Tidelift, now part of Sonar, let procurement sign a normal contract while the money reaches maintainers. If your company runs PHP in production, sponsoring the foundation is the most direct option available.
Treat core open source as public infrastructure. Germany's Sovereign Tech Agency funds maintenance and security work on projects like PHP without asking for features in return. More governments should copy it.
Write maintenance into large contracts. When a government or enterprise signs a multi-million-dollar contract with a cloud provider or integrator, a set share of the value, say 0.5 percent, should go to the upstream projects listed in the system's Software Bill of Materials. [Develop this with one worked example.]
Still patching
As I write this, a day after the patch shipped, companies are still upgrading servers and attackers are already testing variations on the exploit. When this is over, the corporate teams will take their comp time. The PHP Foundation will go back to closing a $139,000 gap.
The industry has shown it will spend serious money to find bugs in PHP. The question is whether it will spend a fraction of that on the people who have to fix them.
Comments