Someone sent me an image from Blick, the Swiss tabloid. “RED ALERT ON THE INTERNET! Attack waves imminent” scream the usual big bold letters. The headline has joined alarm bells from all around the world ever since PHP2Shell became public on Wednesday 21st at 16:00 Swiss time (CVE-2026-109618, CVE-2026-109619). While I appreciate the Star Trek reference, the doomsday mood is increasingly irritating. Something does not sit right with me, so I need to think, write and analyze.

Usually, when critical vulnerabilities are published for Ivanti, Fortinet, Citrix, and friends, mass exploitation follows within 24 hours. Sometimes even before publication. Edge devices are the hot new targets on the threat landscape according to various reports. Mass pwnage is a thing that actually happens.

What about PHP2Shell?

Crickets.

It’s Saturday now.

Media reports announce doom, death, The End, while working PoCs and exploits remain scarce. Previous PoCs were shown to be ineffective, vibe-coded or only working under very specific conditions. And no, “attempts” are not the same as actually pwned servers.

Some researchers have observed this already, such as Marcus Hutchins, Elias Taylor or Kela Security. Even the Wiz researchers note that memory bugs are hard to exploit – they were only able to discover the vulnerabilities via LLM-supported research.

So what’s at play here? Something you learned to analyze as a Sinologist who specialized in literary studies. So let’s investigate the underlying narrative, look beyond the headlines and read between the lines. And when a story is too good to be true, it’s good to remain skeptical.

Here’s what we have:

1. OpenAI is in fierce competition with Anthropic.
2. Both aim for an IPO.
3. Both need to make money, because they’re burning it like others burn paper money for their ancestors.
4. Both push the narrative that dangerous AI will take over the world, they have the ultimate solution, and they’re just helping and protecting us all.
5. Any support just costs some money and/or select groups are invited.

And, as Elias Taylor notes: PHP is insecure as hell; the fear of a pwned whatever is looming over everyone and everything. The vulnpocalypse is nigh, although it quickly dissipates when looking closer.

Fear is a very, very strong driver, along with uncertainty and doubt – also known as FUD.

Stories are a very, very strong driver too, because they’re at the core of social interactions. They also drive clicks and money-making.

How do sects operate, authoritarian regimes keep in power, newspapers make money? By telling compelling narratives coupled with fear.

“If you don’t vote for me, we will be invaded by this alien species from Alpha Centauri”.

“The world is going to end, but if you join my community and buy this blessed water for 200$, you’re safe”.

“If you post this on the Internet, police will visit you - happened to a friend”.¹

“You won’t guess why the world is ending unless you click this link.”

So here’s the counter-narrative to the doomsday headlines:

An AI company desperately needs to keep investors happy and make money. The company pushes the narrative that their own product is too dangerous to roam freely, yet has also immense benefits to select users. The company therefore provides tools to underfunded communities (aka open-source maintainers) and researchers, to help making the world a better place.² Finding very dangerous(tm) vulnerabilities helps said communities and The World, but also proves that the company has the ultimate solution to all our worries and can save us from doom.

Wiz and Calif both note the support from OpenAI, and OpenAI grandly adapts a “Hackers” movie quote to show its generosity to the world. Who benefits from the whole free publicity in the end? Yes.

However, there’s now a silver-lining: The world knows (again) about PHP and its maintainers and hopefully some more servers got patched.

Hey, have you ever heard of PHP plugins?

PHP2Shell Links

• Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (The Internet is PHP, cats and pr0n)
• OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (sprinkled with “Hackers”)
• Calif: A tale of two PHP remote vulnerabilities (ah, they even quote Dickens)

Final Remarks

Yes, this blog post has a snarky undertone on purpose. I’ve been observing mass exploitation of various things for way too long and it is again bizarre which instances make global headlines and which not.

Update 2026-10-29: Jan Schaumann has a blog post in a similar tone, writing how this year’s Cybersecurity Awareness Month is just DDoS-ing Blue Teams for real.

Image source: photograph graciously provided by a (worried) friend and slightly edited to remove irregularities.

Last modified on 2026-10-24