A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites — or if they couldn’t update right away, they should take the sites down to be safe. On this week’s episode of TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane, and I discussed the significance of the PHP-ocalypse and whether we’ll see more incidents like this in the future. Sean called this “a real reckoning moment” that highlights how “when you get down to the bone level of the internet,” everything seems to be “held together by glue and dreams.” And with widespread access to large language models and AI agents, it’s only going to become easier to find these vulnerabilities. (That said, these specific vulnerabilities were found by human researchers, not AI models.) Kirsten, meanwhile, wondered if we’re about to see the “next level of prepper doom […] because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now.”
On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them. The bugs are dubbed PHP2Shell, officially designated as CVE-2026-109618 and CVE-2026-109619. In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data. As situations go, this was a pretty sizable one, forcing millions of people around the world to scramble to patch their systems before malicious hackers could abuse them. The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs, which when installed prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching. Thanks to weeks of backroom chatter and careful coordination across the industry, the world — so far — broadly avoided mass internet exploitation. From Wednesday, governments began urging citizens and companies with websites to take action to mitigate the risks on their ends. A wide range of industries shuttered their websites and pulled services offline to patch their systems. Banks, retailers, gaming sites, online stores, hospitals, and some government agencies took down their servers to prevent attacks. But security researchers are warning that the situation isn’t over yet, and that a large number of systems around the world remain unpatched and vulnerable to hacks and data theft. This is also unlikely to be the last major internet software scare, with some expecting the advent of AI to rapidly uncover as-yet-undiscovered vulnerabilities that are waiting to be found and abused.
