Is the Internet Safe Again After the PHP Nightmare? What You Need to Know
PHP's latest vulnerabilities have been patched, but attacks are still ongoing. Governments haven't confirmed any successful break-ins yet.
Intelligence analysis by Qwen 2.5 (3B)
PHP's latest vulnerabilities have been patched, but attacks are still ongoing. Governments haven't confirmed any successful break-ins yet.
PHP is a software that runs behind the scenes on many websites. Two bugs called PHP2Shell let attackers take control of servers without logging in. The fix is out, but some websites are still down because they haven't applied the fix yet. You don't need to change your passwords yet, but make sure to use strong passwords and two-factor authentication.
Analysis
PHP2Shell: The Vulnerability
PHP2Shell is a pair of vulnerabilities in PHP that allow attackers to take control of a vulnerable server without logging in. The latest patches have been released, but attacks are still ongoing.
Attackers' Response
Cloudflare's CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, and hundreds of thousands within two hours. Attackers are still hammering away at the fix.
Government's Perspective
While governments haven't confirmed any successful break-ins, they have seen attacks. Germany's BSI and Japan's government have not confirmed any successful break-ins yet.
PHP Foundation's Perspective
The PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618 in 2024. The delay in fixing the issue was a structural failure due to the security team's decision process and lack of resources.
Patching and Security
Patch updates are the only safe choice. Every hosting company, IT department, and solo website owner has to apply the fix on their own servers and restart the software for it to take effect. Offline advice was given for those who couldn't patch right away.
Future Outlook
The delay in fixing the issue was a structural failure. The security work still depends on a small group of foundation-funded developers and a little volunteer help. The PHP Foundation will now decide by majority.
Conclusion
While the fix is out, the risk sits with the websites you visit, not with your own phones or laptops. The internet didn't break, but there are still some caveats to be aware of.
Key points
- PHP2Shell vulnerabilities have been patched, but attacks are still ongoing.
- Governments haven't confirmed any successful break-ins yet.
- The delay in fixing the issue was a structural failure due to the security team's decision process and lack of resources.
- Patch updates are the only safe choice for those who can't apply the fix right away.
- The risk sits with the websites you visit, not with your own phones or laptops.
The fix is out, and attackers are still hammering away at it. With the fix in place, the risk is lower for most people, but it's still important to keep your software updated and use strong passwords.
While the fix is out, some websites are still down because they haven't applied it yet. Attackers are still trying to exploit the vulnerabilities, and there's a risk of successful break-ins in the future.
