PHP2Shell: Why Flaws in Widely Used PHP Software Have Security Teams on Alert

A set of vulnerabilities collectively known as PHP2Shell has dominated security news this week. According to The Register's Kettle podcast, most of the internet runs software that could allow remote code execution on host systems through a pair of flaws, which by the latest count has grown to three. The hosts describe the situation as a "PHP apocalypse" and note that the web is warned to expect widespread impact.

The discussion argues that the problem should not come as a surprise. The internet has been chained together over decades with makeshift solutions, so old software containing equally old vulnerabilities is common. The episode features host Brandon Vigliarolo, security editor Jessica Lyons and open source reporter Liam Proven, who offers views on PHP itself and why this situation has arisen.

The hosts also say AI played a key role in finding another issue that no human would likely have discovered unaided. They suggest that exposing more weaknesses in the code underpinning the world's computers could prompt a broader rethink of how that foundation is built. This is only the opening of the episode, so details on how severe the flaws are and the state of fixes were still to be covered in the discussion.