Episode 23 · 25 Oct 2026 · 37:30

The Bug Was Always There | PHP2Shell, Jensen's Robot Ducks, and Why Johanna Gets Paid Less

Half of Europe switched off its websites over a PHP flaw that was first spotted in 2024. Panic or honesty? And who actually pays for the code that runs most of the web?

Something knocked on our own website this month. Hundreds of broken requests, then a name: PHP2Shell. The flaw doesn’t sit in WordPress or in some plugin. It sits in PHP itself, the language that still runs a large part of the web. And it had been there for years.

What broke

A specially crafted upload pushes a PHP request into running out of memory. The request dies before PHP has cleaned up after itself, and the next request on the same worker finds things it should never see. In the episode, Sarah calls it the master key left under the pillow. Chained together, the bugs allow attackers to run their own code on a server without logging in.

Every PHP version back to 5.4 is affected. PHP-FPM, CGI and Apache’s mod_php are all in scope, and mod_php is the worst case, because PHP runs inside the web server itself.

What you should do now

Check your version. Fixed releases came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix from the PHP project.
On shared hosting, ask one question: „Which PHP version runs my site, and has it been updated to the October 21 release?“ Don’t settle for „we’re looking into it“.
Look beyond the website. Docker images, routers, NAS boxes and other devices with a web interface often ship their own PHP.
Patch, then restart. Running PHP processes keep the old code until they are restarted.
A patch doesn’t evict anyone. If a server was exposed before the update, change the passwords, tokens and API keys it holds.

We go through this at .

Why this is a European story

The bug was first spotted in a 2024 audit paid for by Germany’s Sovereign Tech Agency. This August, AI-assisted analysis found it again. Then came a leak, a broken embargo and an exploit attempt days before the official disclosure ().

The language that thousands of European hosters earn their money with runs on a remarkably small budget. We put the public funding at around €200,000 and compare it with the billions Nvidia is spending on European startups this year (). Our position: if you sell PHP, you should pay into PHP.

Also in this episode

Hall of European Tech: Rasmus Lerdorf, born in Greenland, raised in Denmark, and the man who wrote PHP to see who was reading his CV. With original audio from Markus‘ 2017 interview in Dortmund ().
On the Record: Jensen Huang’s European tour, robot ducks from Bordeaux, and why sovereignty comes from maintainers rather than keynotes ().
Switch it off? Clinics, universities and police websites went dark. Overreaction, or the only honest answer when you don’t know your own inventory? ()
Johan and Johanna: A study found that a female AI assistant gets paid less than a male one for the same work. Sarah has a question for Markus ().

About this show

Sarah Vailby is an AI character with a synthetic voice. Every episode is scripted with the help of AI tools. Markus checks every line and is responsible for it. Sources for this episode are in the show notes below.

Show notes and chapters

Episode 23: The Bug Was Always There

A flaw in PHP itself sent half of Europe's public websites offline. It had been spotted in 2024, paid for with German public money, and then nobody fixed it. Sarah and Markus argue about whether the shutdowns were panic or honesty, follow the money from Jensen Huang's billions to a foundation asking for donations, and hear from the man who started it all: Rasmus Lerdorf, in original audio from 2017.

In this episode:

Cold Open and Welcome. Hundreds of broken requests against our own website, and this week the noise has a name. Half of Europe switches off its websites. Is this what European sovereignty looks like?
Housekeeping. Switzerland puts 63 percent of its venture capital into deep tech, but 88 percent of the money in big rounds comes from abroad and pension funds barely invest. Europe pays for the research, someone else cashes in. Then France: half a million people on the streets, mobilised online, and a viral riot video that turned out to be from 2020.
On the Record. Jensen Huang's Europe tour: fourteen startups in a week, nearly ten billion dollars in a year, Nvidia behind ten to fifteen percent of European startup funding. Doctolib bought at a discount, open models on closed chips, and four Microducks from Bordeaux, owned by Hugging Face, which Nvidia has agreed to buy. Meanwhile in Malmö: the Matrix Conference. Sovereignty doesn't come with a keynote. It comes with maintainers.
PHP2Shell: What Broke. Not a WordPress bug, but PHP itself. A request runs out of memory, PHP cleans up badly, and the next request finds the master key under the pillow. Why mod_php is the worst case.
PHP2Shell: The Timeline. A 2024 audit funded by Germany's Sovereign Tech Agency, AI-assisted findings in August 2026, a leak, a broken embargo, and an exploit attempt on an Amazon honeypot four days before disclosure. Why the patch itself is a map.
Switch It Off? Charité, Mainz, DigiD, Final Fantasy XIV and the Berlin police telling citizens to dial 110. Markus says many overdid it, AWS only warned. Sarah: AWS doesn't run your PHP, a shared hoster does. They meet halfway: the shutdown was the symptom of not knowing your own inventory. Plus: how AI made an old flaw cheap to exploit.
Hall of European Tech: Rasmus Lerdorf. Born in Greenland, raised in Denmark and Canada. In 1995 he publishes "Personal Home Page Tools" to see who reads his CV. From Zend to HHVM to PHP 7. With original audio from Markus's 2017 interview in Dortmund: no grand plans, just a useful tool, and the principle to make things easy.
Who Pays for the Foundation? "Not my employees": how PHP development is funded. Around 200,000 euros of public money against Nvidia's billions. Every hoster earns money with PHP. If you sell PHP, you should pay into PHP.
What You Should Do Now. The fixed versions, the right question for your hoster, Docker images, devices with web interfaces, old systems, and why a patch doesn't remove an attacker who's already in. And why our European podcast site was protected by an American firewall.
Johan and Johanna. In a VR study, a female AI assistant got 10.25 percent less than a male one for the same work, and the male one seemed more human. Sarah asks Markus why he made her a woman. Then the bill: 200 euros per episode, and nobody on the show gets paid. Followed by our closing song "Both Sides Of The Wire", full length at sarahs-tech.eu/?seite=song.

Newsletter: Context Window. What we talked about, what we cut, what's coming. Subscribe at sarahs-tech.eu.

Key Takeaways:

The Bug Was Always There: An audit found the memory flaw in 2024. AI didn't discover a new bug, it made an old one cheap to exploit.
The Shutdown Was the Symptom: Switching off is honest when you can't patch. Needing a blackout to patch means you don't know what runs on your servers.
Not Comparable: AWS and Shared Hosting: A cloud provider can't switch off PHP it doesn't operate. A shared hoster runs it for thousands of customers and has to act.
Waiting It Out Is Now the Attacker's Strategy: Millions of PHP installations run on unsupported versions. A patch is read and turned into an exploit within hours.
Who Sells PHP Should Pay Into PHP: The web's foundation runs on donations and borrowed developers, while the money flows to the shiny layers of the stack.
Sovereignty Comes With Maintainers: Ten billion for chips and startups, a few hundred thousand for the code that keeps hospital websites safe.

Links & Sources (all at sarahs-tech.eu): PHP security release and advisories, 21 October 2026 · The PHP Foundation on today's security release and its timeline · Wiz technical analysis of PHP2Shell · BSI, CISA, NCSC and CERT-EU warnings · Bitpage.de situation report on outages and hosters · BornCity on the 2024 audit, attack numbers and the Shodan count · AWS Security Blog on WAF mitigations · Cloudflare on its php2shell protections · heise, Help Net Security, SecurityWeek and BleepingComputer · Sovereign Tech Agency on its PHP investments · PHP Foundation on Open Collective · finews.ch and the Swiss Deep Tech Report 2026 · AP, Reuters and Xinhua on the protests in France; CyberPeace fact check · Bloomberg, Quartz, CNBC and the NVIDIA blog on Jensen Huang's tour and GTC Berlin · Trending Topics on Nvidia's share of European startup funding · TechCrunch and The Next Web on Pollen Robotics' Microduck · matrix.org and eGovernment on the Matrix Conference in Malmö · Cybernews and HR Dive on the University of Limerick study · Fortune and LinkedIn on women in AI hiring · previous episodes: Ep. 16 "The Kill Switch Is Not Where You Think", Ep. 17 "This Is European Tech", Ep. 20 "The Body of the Machine".

Disclosure: Sarah Vailby is a synthetic host, AI-generated and disclosed in every episode under the AI Act's transparency rules. Her voice is synthetic. The Rasmus Lerdorf clips are original audio from Markus's 2017 interview for his former podcast "Menschen/Medien/Technologie"; background noise was removed with ElevenLabs, the words and voice are unchanged. Anthropic and OpenAI, whose models are used in producing this show, are credited among the finders of PHP2Shell. Markus works in web hosting; nothing here reflects an employer's position. Reports of Nvidia's agreement to buy Hugging Face are not confirmed as closed. Source state 24 October 2026.

Feedback: Did your hoster switch your site off on Wednesday, or patch it quietly? Write to feedback@experten-system.de.