France’s info.gouv.fr showed as unavailable, Dutch and Finnish agencies pulled sites, and Germany’s federal IT provider took several offline. Everyone was waiting on a patch.
The patch was for PHP, which runs majority of the web, including WordPress, Drupal and Joomla. Two bugs, nicknamed PHP2Shell, can let a stranger run commands on a server with a single web request and no login. PHP handles that request before the site’s own code even starts, so strong passwords don’t help.
Both come down to PHP trusting work it never finished. In one, PHP runs out of memory while reading a form, after it has already counted an entry it never filled in. Cleanup later reads that empty slot as real data. In the other, PHP holds on to a pointer to memory after it’s been freed, and a later request can follow it.
Researchers at Calif, Wiz and OpenAI used AI models to find bugs that had sat in PHP for over a decade, and Wiz says one person did in a week what once took a strong team months. Amazon’s honeypots logged an attack attempt on October 17, then details leaked early and the patch got pushed up a day.
If you run PHP anywhere, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There’s no complete workaround, so updating is the only real fix.
A bug sat in the code behind most of the web for over ten years, and a couple of months of AI-assisted work turned it into an emergency. I wouldn’t panic over it. But it’s worth knowing what your sites run on and who keeps it updated, and most of us can’t say that for our own college or official websites.