A critical Php2Shell vulnerability has been found in the PHP programming language, which was released more than 30 years ago and is still widely used to build websites. It has caused a major stir. There have been no major incidents so far, but many say it is too early to feel at ease.

Jan Kammerath (얀 캄머라스), a developer who has written PHP code since 1999, also warned in a recent Medium blog post titled, "Was PHP2Shell serious? PHP is about to face a bloodbath," that Php2Shell is only the beginning of a process that will expose problems that have built up for decades.

PHP2Shell is a vulnerability (CVE-2026-109618, CVE-2026-109619) in the runtime environment that executes PHP code. Because it is a serious flaw in the runtime itself, it affects all PHP codebases, Kammerath said.

He pointed to AI as a key variable. Until now, security researchers lacked the time and budget to examine PHP, but advances in AI-based security research have made it possible to dig into PHP again.

He repeatedly warned, "AI security research has become a threat that will make it hard for PHP to last long. PHP maintainers will keep paying a high price."

He also cited PHP's design philosophy as a problem. In his view, PHP focused on making web development as easy as possible for beginners, and security was sacrificed as a small number of developers added features they wanted.

Kammerath said, "Even if PHP itself is rebuilt in a safe language like Go or Rust, most design-derived problems will remain the same." He added, "There is also far too much low-quality code copied and pasted by inexperienced developers from the time when demand for web development was exploding."

PHP's structure also does not fit the cloud era. LAMP, which bundles Linux, Apache, MySQL and PHP, is an early-2000s approach but still functions like a standard in many PHP apps.

He said, "To run a PHP app in a high-availability environment, PHP alone was not enough, so we had to write many supporting programs separately in Go." He added, "PHP is seen as an easy language for beginners, but in the field of running large-scale services it is the hardest opponent to handle. As much convenience as developers gain, administrators lose stability."

Its cost edge has also disappeared. PHP's strength was that it could be written faster and more cheaply than C++, but he said that with the advent of AI coding tools, using Rust or Go can sometimes be faster. He added that as an interpreted language that executes by interpreting code line by line, it uses more memory and computing resources, which is also a burden.

Kammerath said he respects developers who write good PHP code, and he does not think PHP will disappear, as with Fortran and COBOL. He said, "Programming languages don't die; they are slowly forgotten. People use PHP because someone wants WordPress, not because they choose it themselves." He added that if you are a PHP developer, it is time to leave, and gradually moving apps to Rust or Go is the best for customers.