For the last few days, PHP has been front-page news. Not "new framework release" news, but actual front-page, your-relatives-texted-you-about-it news. The two critical remote code execution bugs patched on October 21, the ones people are calling "php2shell", turned into the kind of story that lands on the desks of people who have never written a line of code. Watching it unfold has been equal parts fascinating and ridiculous, and I want to write some of it down before the news cycle forgets PHP exists again.
PHP went very mainstream
Japan's prime minister, Sanae Takaichi, posted about it. The prime minister of the Netherlands weighed in too. The New York Times reported that Finland temporarily took its government websites offline, and that the UK government and several German cities did the same. The NSA published an advisory recommending the patch.
Think about that. Heads of state and the NSA, all talking about a bug in the language an embarrassing amount of the Internet likes to pretend isn't around anymore.
Everyone suddenly wanted to know how big PHP is
The Wall Street Journal ran the headline "AI Just Found a Bug That Puts Up to 70% of the World's Websites at Risk", with a dramatically lit portrait of the PHP Foundation's Volker Dusch that made him look like the suspect in a Nordic crime drama. That 70% figure was everywhere. CBS News ran "the PHP bug affecting 70% of the world's websites", the Associated Press had a flaw that "could impact 70% of websites worldwide," and Al Jazeera asked what could "pull down 70 percent of the internet." It is close to real, too. W3Techs puts PHP on about 70% of the websites whose server-side language is known. Obviously "the sites we can identify" is not the same as "the world's websites," but even the careful version is a huge share of the web.
One report making the rounds said PHP built 15% of all new sites over the past 30 days. For a language people keep declaring dead, that is a lot of fresh PHP.
The reach showed up in oddly specific places too. AppleInsider warned readers that the flaw reached the NAS box in their closet. In Philadelphia, SEPTA's real-time transit tracking went dark and came back only after the agency installed the patch. A lot of quiet infrastructure runs on PHP, and this week a chunk of it blinked at once.
And how few people it rests on
The Atlantic ran a profile of Ondřej Surý under the original headline "the man who saved the internet." The headline is overcooked, but the point under it is real. A huge share of the world's servers install PHP from packages one person maintains.
The PHP Foundation's own account of the release is blunt about the same problem. It called the stalled fix "a structural failure, caused by both the security team's decision process and its lack of resources," and closed with a request for funding. The week made the bus factor visible to everyone at once.
The ignorance was something else
Half the world's newsrooms had to stop and run a "What is PHP?" explainer first. The New York Times ran a plain "What Is PHP?" explainer. CBC asked "What is PHP, and how did a flaw in its code lead several websites to go dark?" USA Today went with "A basic explanation of the 'critical' PHP vulnerability." A language running a big slice of the web, and the general press was introducing it to readers from scratch.
My favorite moment: the BBC put its cyber correspondent, Joe Tidy, on air to explain the flaw, under the title "How significant is the PHP flaw?" The caption read:
Cyber correspondent Joe Tidy says he didn't know PHP existed until yesterday morning - it's "one of these things we take for granted", he says.
The honest answer to "how significant is it," apparently, was "significant enough that I found out it was real yesterday."
Then there was the crowd under every thread asking "people still use PHP?" and announcing that "real devs don't use PHP," often from accounts that, on a quick scroll, had never shipped anything at all. It is a strange thing to watch people confidently dismiss the technology running sites they use every day, without realizing.
The part that actually matters
Here's what we're seeing on day two-ish: for all the noise about active exploitation, nobody has produced a confirmed, successful php2shell compromise. Wired ran a piece on hackers "exploiting" the bugs before the patch, and The Guardian counted "millions of attempts" against sites worldwide. But NBC News reported that those hackers "appear to be struggling" to make any of it work, which lines up with the PHP security team saying it "did not identify any functional exploits at the time of release/public disclosure." Probing is not the same as popping a box, a distinction the fight over Chainguard breaking the embargo already turned on.
So, a sigh of relief, for now. Patch anyway, restart your workers, and don't read "no confirmed exploit yet" as "safe."
What stuck with me isn't the bug. It's that the loudest voices calling PHP dead spent a week finding out they've been standing on it the whole time. PHP spent ten years as the internet's punchline. This week it was the headline, and it held.
