Behind the PHP2Shell flaw lies a structural problem that goes beyond the code. The PHP Foundation, which develops and oversees the language used by a huge share of websites, has one full-time person and 14 contractors who are "mostly part-time". Its executive director, Elizabeth Barron, explained in an interview that the team must maintain PHP's core while accepting outside contributions, a model similar to the Linux kernel but without the same number of company-paid developers.
A funding problem with deep roots
The out-of-memory vulnerability was first discovered in 2024. According to the PHP Foundation, the fix stalled and restarted repeatedly over months, given the language's reach and the number of third-party extensions. Adding to the trouble, the security firm Chainguard broke the embargo on the flaw. The Foundation says its funding let several people work on the issue full time, including weekends.
The real problem: versions no longer receiving updates
On paper, any server running PHP 8.x could have been patched in minutes. In practice, many sites went offline for hours or days out of fear of attack. The key figure is that about 73% of PHP installations were already past end-of-life. Some servers still run PHP 7, which lost support four years ago, while the branch originally came out in 2015. The changes needed to move from PHP 7 to PHP 8 mostly involve obsolete functions and libraries, with deprecation warnings announced for years.
An emergency that hit public services too
The flaw had concrete effects: the UK government, London's Metropolitan Police, Finnish state services and the Dutch portal Overheid.nl took some sites offline as a precaution. GOG also went offline for a few hours for maintenance. Amazon Web Services detected an exploitation attempt on October 17, four days before public disclosure, coming from an IP address linked to a commercial anonymization network.
Not everything is about the code
According to the analysis, the root cause is a mix of neglect, cost-cutting and poor maintenance. AI-driven automated attacks are only part of the picture: servers left behind for years are the easiest targets.
No comments yet. Be the first!