Unless you’ve been living under a rock it would have been very difficult to miss the news about the snappily named security reports CVE-2026-109618 and CVE-2026-109619 – more popularly known in the press as The PHP Apocalypse or PHP2Shell for those in the know. Rated 9.2 out of a possible 10 according to CVSS v4.0 it is a fault which is essentially almost as bad as it can get.
What is the PHP2Shell vulnerability?
This vulnerability allows anyone to execute any code they want on a web server running PHP. It gets a high rating due to the fact that an estimated 70% of websites currently run an affected version of PHP. Which versions of PHP are affected by PHP2Shell? Pretty much all of them – especially those running WordPress which uses PHP to provide the app. Many sites use WordPress in the background not just those which are blogs. That includes this blog plus several of our other related sites.
How was the PHP2Shell vulnerability found?
The PHP flaw was found by a coalition of AI agents which included OpenAI. It’s good it was found, and even better that there is a PHP2Shell PHP patch available and CloudFlare has deployed protection to help prevent “bad actors” from exploiting it. That said, you’re going to see a lot of websites having ‘a few issues’ as IT teams around the World work to patch the problem, including some Embarcadero and Idera servers.
What is Embarcadero doing about the PHP2Shell vulnerability?
Our (Idera) IT team have been working flat-out to patch all servers which might be affected. Since we also use CloudFlare to help protect our servers we additionally have the benefit of their mitigation rules. Only a reckless IT admin would say their servers are 100% safe from the naughty people of the internet, but we’re on top of this and following all the available advice and best practices. If you have any websites or blogs of your own and have not yet had them patched I strongly recommend you drop everything and deal with it. The process in most cases is reasonably straight-forward depending on how old your web stack is and how up to date your servers are – but in any event we care about your security as much as we do our own.
I could try and score some points here about the inherent security of Delphi since it compiles to native code and WebStencils which doesn’t use PHP in the processing of the web content – but PHP is a credible and well-loved language, and rightly so. It’s not the fault of PHP per se, and it took massive, concerted AI effort to find the problem after decades of it lying dormant. Kudos to the PHP Team for jumping on it and releasing a patch so quickly.
Reduce development time and get to market faster with RAD Studio, Delphi, or C++Builder.
Design. Code. Compile. Deploy.
Free Delphi Community Edition Free C++Builder Community Edition
