Seven claims. Seven fact checks. No hype.
Applying PHP patchPHP2Shell made headlines about AI, millions of vulnerable websites, and an internet-wide security crisis.
Let’s separate facts from exaggeration.
1. Did AI discover a critical new vulnerability?
Misleading.
The underlying out-of-memory handling problem was already identified by a PHP core developer in 2024, while addressing findings from a security audit.
AI-assisted researchers later identified exploitable paths, additional vulnerabilities, and developed working attack chains.
Finding a programming flaw and developing an exploit are two different things.
2. Is 70% of the internet vulnerable?
False. Twice.
First, the 70% figure refers to PHP usage among websites with a known server-side programming language — not to the entire internet.
Second, even among those PHP websites, only installations running affected, unpatched code and meeting the relevant exploitation conditions are vulnerable.
70% is neither the share of the internet running PHP nor the share of systems vulnerable to PHP2Shell.
3. Are millions of websites infected?
False terminology.
PHP2Shell is not a virus. It is a software vulnerability.
A vulnerable system is not automatically infected or compromised.
A security flaw is not an infection.
4. Have millions of websites been hacked?
Not established.
Security researchers have documented numerous exploitation attempts.
But attempted attacks are not successful intrusions.
Sophos even corrected an initial report of successful exploitation after further investigation.
As of October 25, no reliable evidence establishes widespread successful compromise through PHP2Shell. The actual number of successful attacks remains unknown.
5. Can a single HTTP request take over any PHP server?
Misleading.
Researchers demonstrated serious remote-code-execution attacks, including single-request exploitation in certain configurations.
But successful exploitation depends on the specific vulnerability, runtime, configuration, and memory state.
Triggering a memory error is not automatically equivalent to obtaining a remote shell.
6. Did websites go offline because they were hacked?
Not necessarily.
Many services were deliberately taken offline while operators assessed their exposure and installed security updates.
A precautionary shutdown is not evidence of a successful attack.
7. Is PHP2Shell among the worst vulnerabilities in software history?
Unsupported ranking.
Wiz suggested the findings could rank among the most severe vulnerabilities in software history.
The vulnerabilities are critical. But technical severity alone does not establish their historical ranking.
Actual impact, successful exploitation, and resulting damage are different measures.
Severity is not the same as damage.
So, What Is Left?
Remove the exaggerated numbers, misleading terminology, and dramatic predictions.
What remains?
Two critical memory-safety vulnerabilities in PHP that can allow remote code execution under certain conditions.
They are real. They are serious.
And patches are available.
Not 70% of the internet compromised. Not millions of infected websites. Not an AI-created apocalypse.
Just critical software vulnerabilities requiring security updates.
Patch PHP. Verify the update. Move on.
Based on information available October 25, 2026.
Top comments (0)