PHP2Shell analysis: the flaw was real, the panic was overblown

A DEV Community analysis revisits the PHP2Shell vulnerabilities: two critical memory-management bugs in the PHP engine that Calif and OpenAI reported privately on August 11, 2026. The author argues exploitation is exceptionally complex and that the widely cited 70% figure refers to PHP's share of websites, not compromised servers.

• PHP2Shell covers two critical memory bugs in the PHP engine enabling code execution
• Calif and OpenAI privately reported the issue to the PHP team on August 11, 2026
• The 70% figure is PHP's share of websites, not the number of hacked servers
• Chainguard shipped patched images over six hours early, breaking the embargo