On 21 October 2026, the PHP project released emergency fixes for PHP2Shell, two critical flaws that let an attacker take over a web server with a single request. Around seven in ten websites run PHP, so the impact was immediate. Government agencies in France, Finland and the Netherlands, Wikimedia and the Internet Archive all took services offline while they patched.

If your business runs on PHP, patch first. Then ask a harder question: if you had to change this code tomorrow, could your team do it safely?

What happened with PHP2Shell

PHP2Shell is two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (critical). Both allow remote code execution without logging in. The attack runs before your application code does, so even a well-written app is exposed if the PHP version underneath it is vulnerable.

• Affected: PHP 5.4 to 8.5, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Exploited: Amazon recorded an attack attempt four days before public disclosure, and watchTowr reported attacks in the wild on release day.

The flaws were found with the help of AI, by researchers at Calif working with OpenAI, and by Wiz. AI is making it faster and cheaper to find bugs in old code, for defenders and attackers alike.

"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." (Wiz)

Step one: patch today

• Update to a fixed PHP release, or install patched packages from your Linux distribution or hosting provider.
• If you can't update right away, the UK's National Cyber Security Centre advises considering taking the system offline. Firewall rules help, but they don't replace the patch.
• Check for signs of compromise. Attackers may have planted backdoors before you patched.

PHP 8.1 and earlier are no longer supported. Versions 7.4 to 8.1 received source-code patches only, and older versions received no official fix. If your system runs on one of these, you are relying on a vendor backport or building PHP yourself.

The real risk: code nobody wants to touch

Patching PHP itself is the easy part. The hard part starts when the fix needs a newer PHP version and your application won't run on it.

It's a common story. An internal system or online shop was built ten years ago, extended by several developers since, with little documentation and no automated tests. It still works, so nobody touches it. But every upgrade becomes a gamble, and every security fix becomes a project.

This isn't only a PHP problem. Python has vulnerabilities too, and any language can produce code that's hard to maintain. What made PHP2Shell so painful for many teams wasn't the language itself. It was being stuck on old versions, with code no one fully understood.

Why rebuild in Python

If a legacy system needs modernising anyway, Python is a strong choice.

• The most popular language: Python tops the TIOBE Index (19.23% in October 2026), so developers are easier to hire and well-maintained libraries are easier to find.
• The language of AI: most AI and data tools are built for Python first. Once your system is in Python, adding chatbots, prediction models or document automation is far simpler.
• Readable by design: Python's clean syntax makes code easier to read, review and hand over to new team members.
• Secure defaults: Django protects against SQL injection, cross-site scripting and CSRF out of the box, and FastAPI validates every request against typed data models.
• Modern tooling: type hints, automated testing, linters and dependency scanning are standard practice in the Python ecosystem.

How MAGO AI migrates PHP to Python

We rewrite and revamp legacy PHP systems in Python, with AI-generated documentation, so the result is readable, maintainable and built to current industry standards.

• Audit: we use AI to map your existing codebase, including every page, database table, integration and business rule, even the ones nobody remembers writing.
• Document: AI-generated documentation, reviewed by our engineers, explains what the system does and why.
• Rebuild: we rewrite the system module by module in modern Python, following industry standards for structure, typing and security.
• Verify: automated tests check that the new system behaves the same as the old one before each module goes live.
• Hand over: you get clean, documented code that your own team, or any Python developer, can maintain.

Is it time to move?

Ask yourself three questions:

• Which PHP version are your systems on, and is it still supported?
• Could a new developer understand and safely change the code within a week?
• Did PHP2Shell take your team hours to patch, or days?

If the answers worry you, contact MAGO AI. We'll review your PHP system and recommend a clear plan, whether that's a full Python rewrite, a staged migration or better documentation for what you already have.