As an interesting bit of trivia, Facebook was written on PHP, and was based on PHP until 2014. Obviously, not stock PHP for that long. They wrote a PHP cross-compiler to optimized C++ called en.wikipedia.org - HipHop for before the got entirely off the language.

I worked on PHP for almost several years long ago, and I don't miss it. But I think it gets a bad rep. Poorly written applications of all languages, bad network configuration, bad access control, and bad architecture in some combinations usually are factors.

So this is PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) impacted IwaiCosmo Securities. MITRE is fine but I like Red Hat, they have a bulletin covering both CVEs that comprise the exploit: access.redhat.com: RHSB-2026-013 Request handling memory corruption - php (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) - "php2shell". The paired CVE's have a CVSS 9.2 which is not great.

It looked like Wiz ran point discovering it, wiz.io: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet describes the exploit.

I'm not hear to defend PHP, but the bring up CVE-2026-111497 and mention the AI Inflection Point section in the above Wiz article.

CVE-2026-111497 (RHSA https://access.redhat.com/errata/RHSA-2026:87420, described by Imperva here imperva.com - From brotli data to remote code execution) or "Node2Shell" also has a CVSS of 9.2. It was similarly discovered as part of the AI supported exploit chaining, by OpenAI Codex Security. But instead of PHP it was in Google's brotli data compression library written in C.

Nothing's safe, there is an active, ongoing crisis: https://app.opencve.io/statistics. Be careful out there. GitLab had a CVSS 10.0 vulnerability (CVE-2026-110264), HPE ArubaOS had a bunch, there were these two. There was the eMudhra CA mess/scramble (source of the various "Q: what's your key? A: 4" "jokes").