Long-form TechCrunch analysis of PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP affecting ~70% of web-facing sites (WordPress, Drupal, Joomla, MediaWiki/Wikipedia).
Bugs discovered in 2024, deemed non-exploitable until Calif researchers found exploit path; coordinated disclosure via PHP Foundation embargo. Patches released Wednesday; banks, retailers, hospitals, governments took sites offline to patch.
Calif credited via OpenAI/Wiz “Hack the Planet” initiative; AI assisted exploitation PoC but core discovery was human PHP expertise. Amazon detected exploitation ~1 week before public patches (as early as Oct 17). Embargo breach blamed on one company pushing patches early; Palo Alto and Trail of Bits reported post-disclosure compromises.
Cloudflare CEO Matthew Prince cited exponential exploit attempts after disclosure. PHP Foundation underfunding theme: one full-time staff (Reuters) vs massive dependency. Memory-unsafe legacy stack vs Rust/Python migration narrative. Expect lingering unpatched systems and supply-chain ripple through embedded PHP in appliances/VPNs.
Related prior emergency coverage: Ars Technica pre-patch warning (Oct 21 pipeline item).