PHP bugs expose widespread web vulnerability

Two critical vulnerabilities in the PHP programming language, used by roughly 70% of the web, threatened widespread internet disruption before patches were released on Wednesday, prompting global efforts to secure affected systems. The bugs, dubbed PHP2Shell, allow remote code execution without authentication, potentially granting attackers full control over unpatched servers. The PHP Foundation coordinated an embargoed disclosure, giving major companies early access to fixes, though Amazon detected exploitation about a week before patches were public. Security researchers warn many systems remain unpatched, and confirmed compromises have already occurred. Experts say this incident highlights risks from aging, memory-unsafe software and predicts AI will accelerate discovery of similar vulnerabilities, making future large-scale scares likely.