PHP2Shell, two remote code execution flaws in PHP that existed since 2012, were discovered by researchers at Calif and Wiz in August 2026 with help from OpenAI and Google models. Amazon saw exploitation attempts on October 17, four days before disclosure, and PHP shipped a patch on October 21; exploitation continued that day, with Cloudflare reporting rising attack traffic and CISA adding the flaws to its known exploited list on October 26. Despite the patch, remediation is slow: Verizon’s 2026 DBIR cites a median fix time of 43 days, Qualys reports a mean of 21.2 days, and 63% of critical bugs remain open after a week. As of October 27, Censys counted 32.5 million internet-facing PHP services still running vulnerable versions, plus over 60 million without reported versions. The article argues that beyond fixing the vulnerability, organizations must limit the blast radius by controlling service-account identities, API keys, and tokens that a compromised workload can access. 1