{
  "id": 16212128,
  "title": "More bugs out there: PHP2Shell is just the start",
  "url": "https://urgent.news/2026/10/23/more-bugs-out-there-php2shell-is-just-the-start",
  "topic": "business",
  "section": "Business",
  "published": "2026-10-23T17:42:44.000Z",
  "source": {
    "name": "The Economic Times",
    "slug": "the-economic-times",
    "url": "https://economictimes.indiatimes.com/opinion/et-commentary/more-bugs-out-there-php2shell-is-just-the-tip-of-the-internets-old-code-iceberg/articleshow/135152174.cms"
  },
  "original_language": "en",
  "account": "A pair of bugs, dubbed 'PHP2Shell', have been discovered in PHP, a web development language powering a vast majority of websites worldwide. This vulnerability exists in PHP's memory handling mechanism, allowing attackers to gain access to a server's resources, bypassing security measures. Both bugs were found using AI tools, with the first reported in August by US-based firm Calif and the second in September by Wiz, Google's cloud security subsidiary. Despite the flaws' age, which dates back over a decade, they were difficult to exploit due to the complexity involved. The discovery marks a significant shift in how security is approached, as the models used to find these bugs are becoming more accessible, necessitating urgent action. The PHP team has released patches for the affected versions, but many servers, especially small-scale ones run outdated versions, leaving them exposed. High-profile organizations, including government agencies, have taken down their websites as a precautionary measure. The issue underscores the need for better maintenance and support for legacy systems and highlights the growing importance of AI in cybersecurity.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}