Another October, another existential crisis for PHP. The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) dropped with a CVSS score of 9.2 , a botched disclosure timeline, and a media cycle that practically wrote PHP's obituary for it. As a PHP veteran, I've watched this movie before. But this time, the script is different—and the real story isn't about a language flaw; it's about a culture of not understanding your own code and a convenient amnesia about where the actual breaches are happening.

The Leak Was the Story, Not the Language

Let's be precise about what happened. The PHP Foundation ran a coordinated disclosure process for two critical RCE bugs. The fixes were ready. Patches were released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. The Foundation acknowledged a "structural failure" —the flaw was first spotted in 2024, but the security team, constrained by consensus and resources, stalled on a fix.…