Why the internet almost broke

We've all seen the disaster movie moment where the control-room starts flashing red and JK Simmons (yes) yells "take it offline!"

Well that's more or less what just happened, except the control-room was the internet, and JK Simmons was half the world's governments.

So what — and we cannot stress this enough — just happened?

First, the location: it all went down in a digital world called PHP, which once stood for Personal Home Page but is now a backronym for PHP Hypertext Preprocessor. A Greenland-born coder (Lerdorf above) created the script back in the 90s, and it went on to become the unglamorous plumbing for ~70% of all websites!

For decades it all relied on an informal hobbyist network until some tech firms financed the PHP Foundation from 2021, paying a small team to tend the code.

And one of those nerds then actually found a weird memory issue in 2024, but it all seemed way too complicated for anyone to exploit, let alone fix, until...

Second, the reveal: fast forward to August 2026, and security researchers at Calif (a startup) and Wiz (Google) started aiming powerful new AI models at PHP's code. And sure enough, what humans first dismissed as a jumble of harmless memory quirks, AI quickly identified as a massive 'PHP2Shell' vulnerability, triggering...

Third, the race: those researchers quietly tipped off the PHP Foundation, starting a frantic, confidential two-month race to rewrite the code and patch the hole before any villains got wind. And it was all going to plan for an orderly global update until...

Fourth, the leak: back on Tuesday, 48 hours before the PHP Foundation’s planned roll-out, someone leaked key details, then some more. Who and why? PHP had given a heads-up to key plumbers (think software maintainers and Linux distributors) to help ensure a smooth patch. So it was probably just a classic embargo breach by an ego wanting to be first, but the leak contained enough for...

Fifth, the fallout: the exact sequencing is still unclear, but with AI's help, hackers managed to reverse-engineer then exploit the original flaw within about six hours (!), collapsing a 'patch-to-exploit' gap that used to be measured in weeks or months.

We're still picking up the pieces, but Cloudflare (one of those internet plumbers) has reported detecting thousands of hack attempts after the initial leak, soaring to millions after PHP's big announcement. Anthropic’s deputy info-security chief is warning things “are going to get a lot worse before they get better” (though a cynic might quip this is like a locksmith warning the neighbourhood is about to face a ton of break-ins).

Either way, that brings us to...

Finally, the response: America's NSA, Australia's ASD, Europe's ENISA, and others have all started sounding the alarm for everyone to update their servers or — failing that — just unplug them!

But two buts (or three if you want to count the one starting this sentence): first, more than half the world's PHP servers run old, unsupported versions that no longer get standard updates. And second, because this flaw can open a backdoor before core systems boot, hackers might escape without leaving the usual web-log traces.

So to translate all that high-nerd dialect into English? We know something massive just happened online. We just don't know — and may never know — exactly what.

Sound even smarter:

• In adjacent (if not PHP2Shell) news, banks now say they’re scrambling to vet and block third-party AI agents poking around customer accounts.