Last week, the PHP project disclosed two flaws that let anyone on the internet take over a web server without logging in. PHP runs most of the web, and the flaws were in every recent version, including the newest. Within days, attackers were using them to break into systems across the internet.
This week’s article argues that PHP is legacy infrastructure because languages with far stronger security guarantees are ready to use. We built OpenMatter® using these languages from day one, so PHP2Shell never touched us.
Stay up to date as we build the infrastructure layer for secure AI collaboration:
OpenMatter has joined the Open Secure AI Alliance, the industry initiative hosted by the Linux Foundation. We’re bringing our work on cryptographic verification, privacy-preserving computation, and post-quantum security to its open security efforts for AI agents.
To learn more about the Alliance and how to take part, visit secureaialliance.org.
Even the Newest PHP Is Legacy Infrastructure
Why OpenMatter Wasn’t Affected and What Modern Infrastructure Looks Like
The Flaws Were in Every Recent Version
On October 21, the PHP project shipped an emergency release for two flaws that let anyone on the internet run code on a PHP web server without logging in. Researchers named the pair of flaws PHP2Shell. Five days later, CISA, the US government’s cyber defense agency, added both to its list of flaws attackers are known to be exploiting. By some counts, PHP runs about seven in ten websites.
Using the newest version wouldn’t have saved you. Wiz Research, one of the teams that found the flaws, says every PHP version since 5.4, released in 2012, carries at least one of them. Its exploit worked against the latest WordPress, Drupal, and Joomla container images, and Wiz says even a simple Hello World app on an affected version can be vulnerable. The flaws sit in PHP’s engine, underneath the application, so no plugin update or careful framework could have stopped them.
So the version number is the wrong place to look. PHP was written in C when its source was first released in 1995, and its engine still is. A company that runs PHP in 2026, at any version, runs its websites on an engine written in C. That’s legacy infrastructure, however recent the patch.
The Bug Rust Refuses to Build
The two flaws cover four bugs, and they share one cause. PHP loses track of which parts of its memory are still in use.
Here’s how one of them works. An attacker sends a request that runs PHP out of memory partway through. PHP frees that memory for reuse but keeps a pointer, a note of where it was. The attacker fills the freed space with their own data. The next request follows the old pointer and treats the attacker’s data as its own. That’s called a use-after-free, and with enough work it hands the attacker control of the server.
C leaves the programmer to track which memory is still alive. Rust and Go track it for you, and their programs run with no C interpreter underneath. In safe Rust, the default mode where the compiler checks every use of memory, a use-after-free is a compile error, caught before the program ever runs.
In 2021, Google said that more than 70% of the serious security bugs in Chromium came from memory-safety flaws like these. In June 2025, CISA and the NSA urged software makers to move to memory-safe languages.
Unsupported, Unpatched, and Under Attack
PHP shipped patched releases for branches 8.2 through 8.5. Branches 7.4 through 8.1 got only source patches, for people who compile PHP themselves. Version 7.3 and everything older got nothing from the PHP project.
The threat intelligence firm Mallory counted 2.6 million internet-facing PHP services that report their version. Of those, 73.5%, about 1.9 million, run PHP 8.1 or older, so none of them will get an official PHP release. Unless a vendor backports the fix, copying it onto the older version, their operators face a migration under live attack.
On October 26, the security firm Dream reported that attackers had chained PHP2Shell with a Linux kernel bug to take full control of 24 firewalls and a management server. The firewalls’ management software ran PHP 8.0.30, from a branch PHP stopped supporting in 2023. Three of the machines sat inside a US government-affiliated network.
The flaws had been in the code for more than a decade. What changed is the cost of exploiting them. Wiz says frontier AI models let one researcher do in a week what would have taken a world-class team months. A decade without a known exploit no longer tells you much about whether code is safe.
Why OpenMatter Wasn’t Affected
OpenMatter wasn’t affected by PHP2Shell because we built on modern infrastructure from the start.
The node software for MatterChain, OpenMatter’s network, is written in Rust. So are the services that hold keys and data: the QuantumGuard™ engine, the committee servers that hold shares of the decryption key, and the Masked Compute™ servers. Safe Rust won’t compile the bug class behind PHP2Shell.
Rust is the first defense. The second is what a server keeps in memory. Wiz also showed a PHP2Shell attack that copies a slice of server memory into a cookie and sends it back. That memory can hold passwords, login tokens, and API keys. So we keep secrets out of the places an attacker reaches first.
QuantumGuard keeps an agent’s API keys out of the agent. When the agent calls a service like OpenAI, QuantumGuard adds OpenAI’s key to the request on its way out, and that key goes nowhere else. If an attacker copies the agent’s memory, the way the cookie attack copied a PHP server’s, there’s no key in it to steal.
Secrets entered in the Datavizor™ console are encrypted in your browser before they leave the page. The key that unlocks them is split across a five-member committee and never assembled in one place.
Masked Compute splits data into masked pieces across five independent servers. None of them ever holds the data whole, and the data stays private even if attackers take over four of the five.
The encryption that protects keys and data is post-quantum. If an attacker ever copies encrypted data out of an OpenMatter system, it stays sealed, including against attackers who stockpile encrypted data today and wait for a quantum computer to open it.
PHP2Shell won’t be the last decade-old bug that AI makes cheap to exploit. When an attacker gets in, the damage depends on what they find. On OpenMatter, the services that guard your keys and data are written in Rust. With QuantumGuard, your agents never hold their own keys. Masked Compute never puts your data whole on a single server. That’s what modern infrastructure looks like, and it’s ready for you today.
Don’t trust data. Prove it. Start free in Datavizor.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact our team to learn how masked compute can help.
OpenMatter is chairing the Decentralized AI Agent Alliance’s Agentic Privacy & Security subgroup. Our next meeting will be held on November 4 at 1pm EST, and every other Wednesday thereafter. Please join us.
If you’re curious what DAIAA is all about, you can check out their YouTube for a full archive of meeting recordings.