Two critical PHP bugs nearly broke the internet, experts warn more ahead

Two long-dormant PHP flaws, dubbed PHP2Shell, let attackers break into websites and servers without a password. The PHP Foundation released patches after weeks of quiet industry coordination, and banks, retailers, hospitals and some government agencies briefly took services offline to patch. Mass exploitation was largely avoided so far, but researchers warn the danger isn't over.