On Wednesday, Finland took its government websites offline. The Dutch parliament went dark. Edinburgh council's site disappeared. Parts of Wikipedia stopped loading. Even a few BBC programme pages went down.

The reason: two bugs in PHP, the language that quietly runs most of the web. The vulnerable code had been sitting there for more than a decade. Then AI-assisted researchers turned it into working exploits within weeks, and everything kicked off.

This is the story of PHP2Shell, and I think it's the most interesting security story of the year, because the good guys and the bad guys are about to use the exact same trick.

First, what actually broke

PHP powers roughly 70% of websites, according to Wiz's estimate . WordPress, Drupal, Joomla, MediaWiki (the software behind Wikipedia) and a mountain of shared hosting and control panels all sit on top of it.…