PHP2Shell: The Thirty-Year-Old Foundation Under 70% Of The Web Just Cracked. Again.
Two critical remote-code-execution bugs, present in PHP since version 5.4, found with AI help and patched in a hurry while CISA told people to take servers offline. PHP's security team did a good job. That is not the point. The point is what you have chosen to build your business on.