# It Is Not the End of the Internet. Calm Down.

- Link: https://dev.ejohnny.ro/not-end-of-internet-calm-down/
- Published: 2026-11-01T10:38:34+02:00
- Author: eJohnny

Every few months, the tech press declares the internet dead. This month it’s php2shell
and node2shell — two critical vulnerabilities in PHP and Node.js, discovered with
AI assistance, plastered across every headline with phrases like “October black”
and “the biggest threat in internet history.” If you believed every article, the
internet should have collapsed three times last week.

It didn’t. And it won’t. Here’s why — and what you should actually do about it.

## What is php2shell?

PHP powers roughly 70% of the web: WordPress, Drupal, Joomla, e-commerce stores,
accounting firms, city governments. It’s old, it’s boring, and it works. In October
2026, two critical vulnerabilities were disclosed in PHP, designated **CVE-2026-
109618** and **CVE-2026-109619**, both scoring 9.2 out of 10 on the severity scale.

In plain terms: under certain conditions, an attacker without any account can send
a specially crafted request and achieve remote code execution — running commands
on the server, reading passwords, stealing databases, or taking over the site entirely.

That’s it. That’s the vulnerability. Everything else is packaging.

The flaws were discovered with AI assistance (researchers from Calif, OpenAI, and
Wiz are credited). Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36,
and 8.2.35. If your PHP is up to date, you’re fine.

## What the press got wrong

The headlines wrote themselves:

> “October black. The biggest threat in internet history, known for 22 years. AI
> transformed it into a crisis in 2 days. Millions of vulnerable sites.”

Sounds like the end of the world. Except for one detail the press skipped: **an 
old version does not mean a hacked site.**

The researchers at Tenable did the correct test. They intentionally left 5 vulnerable
sites online to see if they’d get compromised. After a week of massive scanning:**
zero hacked**. Many attempts, zero breaches.

Why? Because php2shell is not Log4Shell (the famous 2021 vulnerability where you
sent a short text string in a form and, if the site logged it, you were in — and
the same string worked everywhere).

php2shell is a chain of memory errors across multiple stages. For exploitation to
succeed, the attack must be tailored to the specific target: how PHP is installed,
what settings are configured, how the server is set up. What works on a test machine
doesn’t copy-paste onto another server.

Hard, but not impossible. With time and AI shortening the search, a determined attacker
can succeed against a specific target. And it has been demonstrated on test systems
and network equipment where all boxes run the same software — there, you tune the
attack once and it hits the entire fleet. CISA (the US cybersecurity agency) added
both CVEs to the KEV (Known Exploited Vulnerabilities) list — confirmed exploited
in the wild, with mandatory patching deadlines for institutions.

Hundreds of proof-of-concept programs appeared on GitHub — some containing malware.
An AI assistant even announced a breach that turned out to be a different problem
in a lab environment. So AI helps, but it also invents.

The Tenable researchers’ conclusion, which I support: patch exposed management interfaces
and neglected equipment now. Everything else on a critical-but-normal schedule. 
Not panic.

Same story with **node2shell** (also called HTTP2Shell): a bug in Google’s Brotli
decompression library, used by Node.js, Python, and others, registered as CVE-2026-
111497. Demonstrated to achieve remote code execution. Fix is a version update plus
restart/rebuild of containers. Serious, but not apocalyptic.

![Colorful code on laptop screen](https://images.unsplash.com/photo-1614064641938-
3bbee52942c7?fm=jpg&q=60&w=1200&auto=format&fit=crop)

Boring code that works. Photo by Unsplash, free to use.

## Why I’m not panicking (and you shouldn’t either)

I’ve been on the internet long enough to have lived through a dozen “end of the 
internet” moments. Log4Shell, Heartbleed, Shellshock, Spectre/Meltdown. Each one
was declared existential. Each time, the internet survived — because the boring 
work got done: patches applied, systems restarted, configs reviewed.

The pattern is always the same: a real vulnerability gets discovered (often with
new AI tools), the press amplifies it into catastrophe, and the actual risk for 
most site owners is manageable if they do the boring maintenance work.

## The story of my friend and the 7 languages

I was answering someone on LinkedIn the other day and it reminded me of this: I 
never understood the rush toward new technologies like Node.js. Before I started
coding myself, I paid a friend to build me an application. After a year, he delivered
nothing — he kept switching languages, chasing novelty. Seven languages in one year.
I ended up building it myself, with no experience, in PHP.

What did I need? A web reporting application — a kind of phone utility tied to a
store’s cash register database, so I could see sales: how much sold, cash vs. card,
by product groups, by VAT. Simple on paper.

The guy chased novelty for a year. Delivered: zero.

I built it myself in PHP, with no experience, without AI. It became a kind of cloud
SaaS application tied to the SQL database of the cash register. Later, as an employee
at ABC Soft, I took the idea further into the internally developed solution [Stoc Manager Online](https://www.abc-soft.ro/stoc-manager-online-1-luna.html),
connected to the database of [ABC Soft POS Manager](https://www.abc-soft.ro/pos-abc-1-luna.html)—
sales by fiscal receipt/invoice, by value and percentage groups, daily and period
VAT, margin, stock, prices, invoices, inventory, order lists. Access from any phone,
tablet, or laptop with internet.

It wasn’t sexy. It was boring. And it worked. And it still works today.

## The same disease, different decade

This is the same sickness: chasing novelty instead of finishing and maintaining.

PHP has been “dead” for 15 years in discourse. Node has been “the future” for 10
years. AI attacks are today’s apocalypse. Meanwhile, everything breaks on the same
class of old problems. The difference isn’t the cool language — it’s the boring 
discipline: apply the new version, restart, limit what’s exposed directly.

I’m not saying ignore php2shell and node2shell. I’m saying put them in order:

 1. **What’s directly exposed to the internet + old and neglected** — now.
 2. **Everything else** — on a normal critical schedule, with updates and restarts.
 3. **No test programs downloaded from the internet** and run on production servers.
    Verify the source.
 4. **No rewriting everything out of fear.** You save nothing by jumping 7 languages
    in a year.

The internet isn’t ending this week. Only the patience of those maintaining things
while others chase novelty.

Apply the new version. Restart. Move on.

## Quick reference: what to do right now

← swipe to see all columns →

  |  Priority |  Action |  Who |  
   |  **Now** |  Update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 |  Everyone on PHP |  
 |  **Now** |  Restart Node.js / Python with patched Brotli (CVE-2026-111497) |  Node/Python users |  
 |  **Now** |  Patch exposed management interfaces (firewalls, routers) |  Network admins |  
 |  **This week** |  Remove old, unused PHP versions from servers |  Everyone |  
 |  **This week** |  Verify no fake PoC tools are running on production |  Everyone |  
 |  **Normal schedule** |  Update dependencies, review configs, test backups |  Everyone |  
 |  **Don’t** |  Rewrite your app in a new language out of panic |  Everyone |

## Frequently asked questions

**Is my WordPress site vulnerable to php2shell?**
 If your host runs an updated 
PHP version (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+), no. Check your PHP version 
in WordPress → Tools → Site Health, or ask your host.

**Should I panic about php2shell?**
 No. Apply the PHP update, restart, and move
on. The vulnerability is real but targeted — not a mass-exploitation scenario like
Log4Shell.

**What is node2shell / HTTP2Shell?**
 A vulnerability (CVE-2026-111497) in Google’s
Brotli decompression library, used by Node.js, Python, and other runtimes. It can
lead to remote code execution. Fix: update and restart.

**Can AI really find vulnerabilities this fast?**
 Yes, but it also invents false
positives. The php2shell discovery was real and credited to Calif, OpenAI, and Wiz.
But an AI assistant also announced a breach that turned out to be a different problem
in a lab. AI accelerates both discovery and noise.

**Should I rewrite my app in a newer language?**
 No. Rewriting out of fear wastes
time and introduces new bugs. PHP (or any mature stack) with proper maintenance 
is more secure than a rushed rewrite in a “modern” framework.

**What’s the real lesson here?**
 Boring discipline beats exciting novelty. Apply
updates, restart services, limit exposure, verify sources. The internet survives
on maintenance, not rewrites.

## Conclusion

The internet is not ending. php2shell and node2shell are real vulnerabilities with
real fixes. The press amplifies them into catastrophes because catastrophe sells.
Your job is simpler than the headlines suggest: update PHP, restart your services,
limit what’s exposed, and ignore the panic.

If you’re running WordPress, make sure your host keeps PHP updated. If you need 
a host that takes security seriously (WAF, isolation, daily backups, expert support),
[Kiravo](https://kiravo.net/) is a solid European option with plans starting at 
€9/month:

 [See Kiravo hosting plans →](https://my.kiravo.net/?affid=228)

Stay calm. Apply the patch. Move on.

### Share this:

 * [  X ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=twitter)
 * [  Facebook ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=facebook)
 * [More](https://dev.ejohnny.ro/not-end-of-internet-calm-down/#)

 * [  LinkedIn ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=linkedin)
 * [  Reddit ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=reddit)
 * [  Tumblr ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=tumblr)
 * [  Pinterest ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=pinterest)
 * [  Telegram ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=telegram)
 * [  WhatsApp ](https://dev.ejohnny.ro/not-end-of-internet-calm-down/?share=jetpack-whatsapp)