PHP2Shell shows how much responsibility underpins our digital infrastructure—and why developers, companies, and private and public funders must shape its security and future together.
On October 21, 2026, the PHP project released the security updates PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These security patches fix two critical vulnerabilities that became known as PHP2Shell.
Software as the Achilles’ heel of a digital infrastructure – Adapted by Sascha Block, based on “Dependency” (xkcd #2347) by Randall Munroe. Original: https://xkcd.com/2347/ – License: CC BY-NC 2.5 – https://creativecommons.org/licenses/by-nc/2.5/
Under certain conditions, the vulnerabilities allow attackers to execute malicious code on servers without prior authentication. Beyond manipulating websites and digital services, this also creates the risk of sensitive data falling into the wrong hands. Operators of potentially affected websites therefore took some services offline as a precaution.
Why does this affect all of us?
PHP is a general-purpose scripting language designed specifically for web development. Its origins go back to 1994, when Danish-Canadian programmer Rasmus Lerdorf developed the first PHP tools. In June 1995, he released their source code.
Today, PHP is one of the foundational technologies of the internet. Many websites, online shops, and digital services use PHP as a core software component. The language and its reference implementation are developed within the community-run PHP project.
These versions fix two critical vulnerabilities that, under certain circumstances, allow an unauthenticated attacker to execute code on servers running PHP.
In addition to malicious code that can cause malfunctions in critical website functions, there was also the risk of sensitive data being exfiltrated by cybercriminals. As a precaution, operators took potentially affected websites offline.
Who is affected by the PHP vulnerability?
In principle, PHP2Shell affects all PHP installations that process web requests and have not yet received one of the recently released security fixes. This applies regardless of whether they run WordPress, the most widely used web content management system, a PHP-based online shop, other web applications, or custom services. However, there are differences when it comes to real-world attack vectors—i.e., how exploitable the vulnerabilities are.
If you’re not sure whether and where PHP is used, you should check promptly and ensure you’re on current security updates and patches. It’s equally important to detect unusual server activity early and investigate potential security incidents.
Versions and patch levels should be checked regularly, and available security updates should be applied—or confirmed with your hosting provider—once they are available and assessed. The good news: fixes for all supported PHP versions are available. Consistent patch management not only protects your own systems, but also strengthens the security of our shared digital infrastructure.
PHP2Shell highlights current challenges in open-source development
The incident makes clear how crucial clear accountability, effective security processes, and sustainable funding for critical software components are to our digital infrastructure.
I therefore recommend:
- 1
Clear ownership and governance:
As soon as cross-product components emerge, you need a clearly accountable owner for prioritization, IT architecture, IT security, further development, and lifecycle management. Otherwise, serious problems arise precisely there—misalignment on quality attributes and diffusion of responsibility.
- 2
Explicit interfaces and compatibility:
When logging, monitoring, roles and permissions, or frontend components are organized, cross-functional interfaces, versioning, and backward compatibility must be clearly coordinated across teams. Otherwise, complexity is merely shifted from one team to another without effectively improving output quality.
- 3
Quality and security requirements:
These cross-cutting components are regularly security- and operations-critical. That’s why non-functional requirements such as availability, security, performance, testability, and maintainability must be defined early and made binding, and directly linked to the relevant quality attributes in the form of acceptance criteria.
- 4
Risk of resource bottlenecks:
Hidden Technology creates synergies, but it can also become a bottleneck. Make sure early on that the necessary resources are available.
- 5
Traceable, robust documentation of the IT architecture:
Architecture decisions, responsibilities, and interfaces should be documented and versioned as ADRs in a single source of truth, ideally Git-based.
- 6
Cost and benefit allocation:
If multiple products or services use the same component, funding, maintenance, and prioritization should be handled via a transparent cross-service/product chargeback model with clearly defined responsibilities. Especially at large scale, this is essential to resolve conflicts around budgeting, further development, and benefit allocation in a structured way.
Digital Transformation & Agile Prioritization: Chapter 2.3.5 “Software product lifecycle”, pp. 40–42, especially Fig. 2.5 “Development of sales, profitability and liquidity over the product lifecycle” – Large-Scale Agile Frameworks – Agile frameworks, agile infrastructure and pragmatic solutions for digital transformation – Sascha Block – Springer Vieweg.
Large-Scale Agile Frameworks – Sascha Block – 2nd edition, Springer Vieweg
Software product lifecycle
Like other products, software products typically go through different lifecycle phases: introduction, growth, maturity, and saturation.
Chapter 2 – Digital transformation and prioritization – Large-Scale Agile Frameworks – Agile frameworks, agile infrastructure and pragmatic solutions for digital transformation – Sascha Block – Springer Vieweg.
While early phases require high investment in innovation and market development, as software matures the focus increasingly shifts to maintenance, security, compatibility, and continuous improvement.
Especially with widely used open-source foundational technologies like PHP, this creates an economic tension: millions of applications and many commercial business models benefit long-term from a shared technological foundation.
The product lifecycle illustrates how sales, profitability, and liquidity of commercial software products change over time. With shared open-source foundational technologies, however, a special tension arises: while many companies benefit economically from these technologies over long periods, their use does not automatically translate into adequate funding for maintenance, security, and further development.
Paradox: even at maximum adoption with demonstrably broad economic use, it’s not uncommon for sufficient funding to still be missing
Especially in the maturity and saturation phase, a technology’s economic importance can remain high—as is often the case with open-source software—even though its maintainers receive far less public attention.
Broadly established economic use does not automatically lead to adequate funding for costly further development and maintenance. Many companies, including corporations with billions in revenue, build and run their products and services on the basis of such often invisible foundational technologies (“Hidden Technology”). This makes it all the more important that the open-source projects and people who secure these technological foundations over the long term also benefit from this economic value creation.
Security fixes, quality assurance, and long-term maintenance are often concentrated among comparatively few maintainers and sponsors.
The greater the dependency on a foundational technology, the more important sustainable funding becomes across the entire software lifecycle.
The three largest donors in the PHP Foundation ranking
in US dollars illustrate how different economic and societal interests in a secure digital infrastructure are:
- In 1st place is Automattic (USD 762,500), the company behind WordPress, WooCommerce, and other web platforms, whose business model directly benefits from reliable PHP technology.
- In 2nd place is JetBrains (USD 476,670), the software maker behind many IDEs such as PhpStorm, IntelliJ IDEA, and PyCharm, which played a key role in co-initiating the PHP Foundation in 2021 to safeguard the language’s long-term development.
- In 3rd place is the German Sovereign Tech Agency (USD 214,115), a publicly funded organization that invests in the security, maintainability, and future viability of critical open-source infrastructures—creating real utility that benefits private-sector companies, associations, and public institutions alike, and is not limited by national borders but contributes value internationally.
PHP Foundation is all of us – Sponsors of PHP
In 2024, the Sovereign Tech Agency funded the first external security audit of the PHP core in more than a decade, coordinated by the Open Source Technology Improvement Fund and carried out by Quarkslab.
Quarkslab has been part of Airbus Defence and Space Cyber since October 2026. According to Airbus, the French company’s cybersecurity expertise strengthens Europe’s capabilities to protect critical digital infrastructures.
The security audit of the PHP core carried out by Quarkslab found 17 security-relevant issues, which the PHP team then fixed. During this work, a developer discovered initial indications in 2024 of a deeper memory-management problem, later identified as the cause of one of the two critical PHP2Shell vulnerabilities.
As early as 2024, during follow-up work on the security audit, the underlying issue behind one of the later PHP2Shell vulnerabilities was identified. Different solution approaches, significant compatibility impacts, and limited development capacity delayed the fix. The PHP Foundation has since transparently reviewed these organizational challenges itself and further developed its decision-making processes.
This shows the lasting contribution independent security audits can make when combined with targeted development work.
Security needs people, expertise, and deserves adequate resources
Four developers from the PHP Foundation worked for about two months to fix the vulnerability. Volker Dusch reports working 70 to 80 hours per week during the critical phase of urgent remediation. Here you can find the very insightful interview that Fritz Sprengart conducted for WDR with the maintainer of the PHP Group.
Dusch explains that fixing spectacular security vulnerabilities is not what motivated him—like hardly any other developer—to make it his profession. Rather, everyone wants to build software that people enjoy using. At the same time, he feels responsible for the safety of the people who use this software.
Even in the age of artificial intelligence, people remain indispensable—people who understand complex technical relationships, weigh risks, and make responsible, validated decisions.
The PHP team’s success deserves our recognition. Errors in software development are hard to avoid. Software developers and IT experts make enormous efforts every day to keep the digital services we use day after day secure. At the same time, the strain on individual teams shows that this kind of load cannot be a sustainable operating model for critical software infrastructure.
Identity and access management with open source
PHP is not an isolated case: similar dependencies arise wherever commercial software products are built on shared open-source foundational technologies.
Keycloak is a good example of how open-source technologies form the basis for commercially supported IAM solutions—such as the Red Hat build of Keycloak. In the telematics infrastructure, specialized software vendors also provide identity provider services for health insurers and generate substantial revenue and profits based on open source.
This is an opportunity to link commercial value creation even more closely with the sustainable maintenance of shared foundational technologies, verifiable security, and effective interoperability.
Precisely because IT security and interoperability demand the highest standards, there is an extremely valuable shared opportunity here: software vendors, clients, and the open-source community can strengthen the sustainable maintenance of critical foundational technologies, verifiable security, and effective collaboration together.
That requires responsibility and mutual commitment, including financial commitment.
Open source enables innovation. Together, we must actively ensure sustainable investment, clear accountability, and effective collaboration. That matters for innovation capacity and our shared future.
Every organization can actively contribute—and strengthen its digital sovereignty at the same time—by knowing its critical software dependencies, continuously reviewing its IT security, and proactively taking responsibility for their long-term maintenance. This explicitly includes engagement in open source.
Wie lassen sich komplexe Softwareabhängigkeiten, klare Verantwortlichkeiten und überprüfbare Sicherheit miteinander verbinden?
Genau darum geht es in meiner Rock-the-Prototype-Podcast-Folge „Trust Union – Warum Standards und Vertrauen Europas wahre Stärke sind“.
Jetzt anhören:
🍎 Enjoy on Apple Podcasts: 👉 qrco.de/bgYEjv
🎧 Listen on Spotify: 👉 qrco.de/bgYEjZ
Thank you for taking the time.
For this perspective.
For this path toward digital sovereignty that sustains us.
Yours, Sascha Block
