What PHP2Shell Reveals About Maintaining the Code Behind Most of the Web

The patched releases are out, and the argument about what PHP2Shell means has already begun. The facts below are as the maintainers, researchers and analysts have reported them, with each view attributed. The technical background is in our explainer, and the day-by-day sequence is in the timeline.

Why did a known flaw sit unfixed for two years?

The PHP Foundation answered this itself. In a post covered by The Next Web, the Foundation said a core developer noticed one of the two memory-handling bugs in 2024 while fixing an issue from PHP's first external security audit. Someone suspected it could be exploited, but no attack path was found and other work took priority. Several competing fixes then stalled for months, each with a cost: broken backward compatibility, a new denial-of-service risk, or forced changes to thousands of third-party extensions. The Foundation called the delay a structural failure rooted in its decision process and lack of resources.

Italy's Il Sole 24 Ore frames the same facts as a cost calculation: the risk of a breaking change was judged higher than the risk of waiting, for software the paper calls more or less indispensable. Calif's write-up notes that a 2024 audit by OSTIF and Quarkslab found a related out-of-memory issue that was never proven exploitable and so was not fixed.

How did the embargo come apart?

PHP's account, relayed by The Register, lists several leaks: CVE numbers circulating on 20 October with wrong details, mitigation advice that went to some critical infrastructure providers, a proof-of-concept video Calif says it published by mistake, and fixed container images that Chainguard published at 07:41 UTC on 21 October, more than six hours early. The Foundation said the early images disregarded weeks of coordinated work. Chainguard's chief executive Dan Lorenc does not dispute the timing but says the company did not leak. He describes the bugs as ones his team found independently with AI tooling, and says exploits can now be built within hours.