What does PHP stand for? Ah Personal Home Page. Not for corporate website, not for enterprise publishing system. It doesn't stand for eCommerce systems designs or bank portal creation kit.
AI drives vulnerability disclosure, not security
| Vulnerability | CVE | Technical Issue | NVD |
|---|---|---|---|
| WordPress2Shell | CVE-2026-63030 | REST API route confusion | NVD |
| WordPress2Shell | CVE-2026-60137 | SQL injection in WordPress Core | NVD |
| Node2Shell | CVE-2026-111497 | Brotli decoder out-of-bounds write | NVD |
| PHP2Shell | CVE-2026-109618 | Out-of-memory memory corruption | NVD |
| PHP2Shell | CVE-2026-109619 | Stale global state / use-after-free | NVD |
AI accelerates bug hunting (via alliterated open-weight models). Commercial grade AI from Anthropic (or OpenAI to a lesser extend) prevents security work, including fixing bugs. Anthropic filed their IPO this week. They need to be compliant; and they don't need the security business. It's not marketable. It's not a needle mover. We know we are too few.
So security work needs to stay grindy, difficult and manual. Fine with me. Job security.
PHP belongs to the dotcom era
PHP rose during the Dotcom era, together with Perl. LAMP = Linux Apache MySQL and PHP. 2000s development, Web 2.0. PHP is a relict of a time, when the first websites were made. For these newish businesses that didn't ship physical goods. Before the Software As A Service (SaaS) industry became a thing. Before my time as a professional, but I understand why PHP became popular.
PHP is not dead, it's what made Linux servers a thing on the internet. Without PHP fewer people would have considered Linux. Granted, many interacted with Plesk or similar solutions only, rather than with the Bash command line at the time, which was or is too intimidating for many users.
Linux is not a beginner friendly operating system. Especially not on a headless server. Plesk, PHPmyAdmin, CMS Mambo (2000s era), website builders in general, made Linux bigger and bigger. Not Bash or C, because there is a steeper learning curve.
WordPress uses PHP, and it's big on the internet
WordPress has many security problems. That isn't just because of PHP. It's inherent to their userbase.
WordPress is big and powers millions of websites. PHP additionally powers Drupal, Joomla, TYPO3, Magento, Laravel applications and many custom websites. I used many of these systems, if not all at a time. As a pentester, but also as an Admin. PHP has helped me on many engagements.
- 40% of all websites use WordPress
- 70% use PHP
Source: W3Tech
- WordPress is resource efficient (in comparison to Java)
- PHP is fast (massive investment in performance)
As we all know, security and performance engineering have some inherent system design contradictions. And you know what: I am fine with fixing a security issue every couple of weeks to help to empower fast websites.
WordPress strategically has the funding to switch from PHP, to Rust or to something else. But the style of vulnerability can also occur in Rust.
WordPress needs the Plesk-style users, the website builder community, and people who buy plugins. It needs the side hustles, the self-taught developers who create something marketing needs.
Today WordPress doesn't even need enterprise developers, it needs its ecosystem with commercial plugins (which AI can cater towards to). WordPress would not benefit from a rewrite in my opinion. It benefits from sitting it out. Together with PHP.
2SHell or to hell? Neither!
PHP doesn't take tangible damage from exploits like PHP2Shell. Neither does Node, but that is a different story. WordPress doesn't really take damage from remote exploits either. Why is that? Why can the projects sit it out?
These projects cater towards an audience, that doesn't (primarily) worry about computer technology, information security or data privacy. Small-scale marketing, shadow IT, peripheral company blogs. Quick welcome pages, for the heck of it.
Horizontally this is a massive amount (70+ million websites), but vertically these are not the bank portals, central financial exchanges, stock broker systems, critical infrastructure terminals for gas, water, smart grids etc.. There are exceptions to this observation, but mostly in third world countries.
PHP belongs into the CMS Mambo setups, with PHPmyAdmin. Into the WordPress quick and easy Web 2.0.
PHP does not belong into financial IT (SAP, Navision), not into industrial (Industrial Control Systems, Operations Technology) or revenue critical (portfolios, high speed transactions, logistics terminals), not into load-bearing or generally "important" systems. And that is not the fault of the PHP developers, who sit it out. That is intended. PHP is for the easy web. Personal Home Page.
Remaining concerns
- (German) eGovernment loves PHP (NextCloud)
- many institutions seem to be under the impression that they don't need to adopt enterprise systems for citizen services
- PHP has access to Mythos (or Daybreak); why don't they find such bugs?
- Should PHP developed in the way it is going forward? Does anyone quantify the damages? Or is there none?