Every few months, the tech press declares the internet dead. This month it’s php2shell and node2shell — two critical vulnerabilities in PHP and Node.js, discovered with AI assistance, plastered across every headline with phrases like “October black” and “the biggest threat in internet history.” If you believed every article, the internet should have collapsed three times last week.

It didn’t. And it won’t. Here’s why — and what you should actually do about it.

What is php2shell?

PHP powers roughly 70% of the web: WordPress, Drupal, Joomla, e-commerce stores, accounting firms, city governments. It’s old, it’s boring, and it works. In October 2026, two critical vulnerabilities were disclosed in PHP, designated CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 out of 10 on the severity scale.

In plain terms: under certain conditions, an attacker without any account can send a specially crafted request and achieve remote code execution — running commands on the server, reading passwords, stealing databases, or taking over the site entirely.

That’s it. That’s the vulnerability. Everything else is packaging.

The flaws were discovered with AI assistance (researchers from Calif, OpenAI, and Wiz are credited). Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your PHP is up to date, you’re fine.

What the press got wrong

The headlines wrote themselves:

“October black. The biggest threat in internet history, known for 22 years. AI transformed it into a crisis in 2 days. Millions of vulnerable sites.”

Sounds like the end of the world. Except for one detail the press skipped: an old version does not mean a hacked site.

The researchers at Tenable did the correct test. They intentionally left 5 vulnerable sites online to see if they’d get compromised. After a week of massive scanning: zero hacked. Many attempts, zero breaches.

Why? Because php2shell is not Log4Shell (the famous 2021 vulnerability where you sent a short text string in a form and, if the site logged it, you were in — and the same string worked everywhere).

php2shell is a chain of memory errors across multiple stages. For exploitation to succeed, the attack must be tailored to the specific target: how PHP is installed, what settings are configured, how the server is set up. What works on a test machine doesn’t copy-paste onto another server.

Hard, but not impossible. With time and AI shortening the search, a determined attacker can succeed against a specific target. And it has been demonstrated on test systems and network equipment where all boxes run the same software — there, you tune the attack once and it hits the entire fleet. CISA (the US cybersecurity agency) added both CVEs to the KEV (Known Exploited Vulnerabilities) list — confirmed exploited in the wild, with mandatory patching deadlines for institutions.

Hundreds of proof-of-concept programs appeared on GitHub — some containing malware. An AI assistant even announced a breach that turned out to be a different problem in a lab environment. So AI helps, but it also invents.

The Tenable researchers’ conclusion, which I support: patch exposed management interfaces and neglected equipment now. Everything else on a critical-but-normal schedule. Not panic.

Same story with node2shell (also called HTTP2Shell): a bug in Google’s Brotli decompression library, used by Node.js, Python, and others, registered as CVE-2026-111497. Demonstrated to achieve remote code execution. Fix is a version update plus restart/rebuild of containers. Serious, but not apocalyptic.

Why I’m not panicking (and you shouldn’t either)

I’ve been on the internet long enough to have lived through a dozen “end of the internet” moments. Log4Shell, Heartbleed, Shellshock, Spectre/Meltdown. Each one was declared existential. Each time, the internet survived — because the boring work got done: patches applied, systems restarted, configs reviewed.

The pattern is always the same: a real vulnerability gets discovered (often with new AI tools), the press amplifies it into catastrophe, and the actual risk for most site owners is manageable if they do the boring maintenance work.

The story of my friend and the 7 languages

I was answering someone on LinkedIn the other day and it reminded me of this: I never understood the rush toward new technologies like Node.js. Before I started coding myself, I paid a friend to build me an application. After a year, he delivered nothing — he kept switching languages, chasing novelty. Seven languages in one year. I ended up building it myself, with no experience, in PHP.

What did I need? A web reporting application — a kind of phone utility tied to a store’s cash register database, so I could see sales: how much sold, cash vs. card, by product groups, by VAT. Simple on paper.

The guy chased novelty for a year. Delivered: zero.

I built it myself in PHP, with no experience, without AI. It became a kind of cloud SaaS application tied to the SQL database of the cash register. Later, as an employee at ABC Soft, I took the idea further into the internally developed solution Stoc Manager Online, connected to the database of ABC Soft POS Manager — sales by fiscal receipt/invoice, by value and percentage groups, daily and period VAT, margin, stock, prices, invoices, inventory, order lists. Access from any phone, tablet, or laptop with internet.

It wasn’t sexy. It was boring. And it worked. And it still works today.

The same disease, different decade

This is the same sickness: chasing novelty instead of finishing and maintaining.

PHP has been “dead” for 15 years in discourse. Node has been “the future” for 10 years. AI attacks are today’s apocalypse. Meanwhile, everything breaks on the same class of old problems. The difference isn’t the cool language — it’s the boring discipline: apply the new version, restart, limit what’s exposed directly.

I’m not saying ignore php2shell and node2shell. I’m saying put them in order:

1. What’s directly exposed to the internet + old and neglected — now.
2. Everything else — on a normal critical schedule, with updates and restarts.
3. No test programs downloaded from the internet and run on production servers. Verify the source.
4. No rewriting everything out of fear. You save nothing by jumping 7 languages in a year.

The internet isn’t ending this week. Only the patience of those maintaining things while others chase novelty.

Apply the new version. Restart. Move on.

Quick reference: what to do right now

Frequently asked questions

Is my WordPress site vulnerable to php2shell?
If your host runs an updated PHP version (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+), no. Check your PHP version in WordPress → Tools → Site Health, or ask your host.

Should I panic about php2shell?
No. Apply the PHP update, restart, and move on. The vulnerability is real but targeted — not a mass-exploitation scenario like Log4Shell.

What is node2shell / HTTP2Shell?
A vulnerability (CVE-2026-111497) in Google’s Brotli decompression library, used by Node.js, Python, and other runtimes. It can lead to remote code execution. Fix: update and restart.

Can AI really find vulnerabilities this fast?
Yes, but it also invents false positives. The php2shell discovery was real and credited to Calif, OpenAI, and Wiz. But an AI assistant also announced a breach that turned out to be a different problem in a lab. AI accelerates both discovery and noise.

Should I rewrite my app in a newer language?
No. Rewriting out of fear wastes time and introduces new bugs. PHP (or any mature stack) with proper maintenance is more secure than a rushed rewrite in a “modern” framework.

What’s the real lesson here?
Boring discipline beats exciting novelty. Apply updates, restart services, limit exposure, verify sources. The internet survives on maintenance, not rewrites.

Conclusion

The internet is not ending. php2shell and node2shell are real vulnerabilities with real fixes. The press amplifies them into catastrophes because catastrophe sells. Your job is simpler than the headlines suggest: update PHP, restart your services, limit what’s exposed, and ignore the panic.

If you’re running WordPress, make sure your host keeps PHP updated. If you need a host that takes security seriously (WAF, isolation, daily backups, expert support), Kiravo is a solid European option with plans starting at €9/month:

See Kiravo hosting plans →

Stay calm. Apply the patch. Move on.