Member-only story
What are the Two PHP Bugs (PHP2Shell) - I explained them in detail
On October 21, 2026, two software bugs took over my entire feed. Security researchers are calling the pair PHP2Shell, and they carry a critical severity rating of 9.2 out of 10.
If you do not work in software engineering, it is easy to scroll past news about server code. I think that is a mistake here. PHP is the programming language that quietly runs about 70 percent of the websites on the internet. WordPress, Drupal, Joomla, Magento, news portals, government sites, and millions of online stores rely on it every second.
When a flaw shows up inside a specific WordPress plugin, only the sites using that plugin are in trouble. Yesterday was different. These two bugs sit inside the core PHP engine itself, and the broken code dates all the way back to PHP 5.4 from 2012. Even worse, nearly half of all PHP websites today run older versions that no longer get automatic security updates.
I want to break down what PHP2Shell actually is in plain English, how researchers used AI to find a fourteen year old mistake, the exact timeline of how the leak happened, and how I view this as someone who builds software products.
What is PHP2Shell?
For anyone looking for the fast facts, PHP2Shell is the collective name for two critical…
