More PHP-like cybersecurity issues coming, software supply chain needs stronger muscles: Experts

Veteran tech leaders are sounding the alarm after serious vulnerabilities were found in PHP forcing several websites to go offline as security teams rushed to apply fixes and safeguard critical infrastructure. Since almost 70 per cent of the internet runs on PHP, their concerns are surely not unwarranted. Nikesh Arora, the CEO of Palo Alto Networks, and Sriram Krishnan who briefly served as the senior White House policy advisor on AI, have warned that the world should brace itself for more such incidents.“I'm more concerned about what comes next. This is just one. There's more to come,” Arora said in an interview with TBPN hours after the PHP broke cover publicly. The warning was accompanied by concern that people might start looking for vulnerabilities out of need for what he called “street cred” likening the discoveries to “trophies” as a way to prove to the world that they are “as smart as the last guy.”“The problem is when you start seeing big things like this happen, you start finding people who are trophy hunters. They're going to say, ‘Where can I find the next PHP and prove to the world that I'm as smart as the last guy,’” Arora said.PHP, a programming language that runs many websites, was found to have critical flaws that could allow hackers to gain remote access to the platforms. While the issues have been fixed with a security update, it has raised concerns as PHP is estimated to power as much as 70 per cent of websites online, as per W3Techs. According to Nikesh Arora, finding major security flaws in something as widely used as PHP, may be what hackers want for street cred. Street cred is a term often used to describe respect or reputation. Arora said, “If you're a hacker, isn't that a street cred that I found that one?”So much so, he claimed that right after the PHP vulnerabilities surfaced online, he received messages from people. “The moment this happened, I had four people message me saying, I found it, or I found it,” Arora added. However, Nikesh Arora made it clear that finding flaws in such systems was not a good thing as it exposed websites to hackers. “I'm like, ‘dude, this is not a good thing,’” he said.Palo Alto Networks CEO @nikesharora says he's more concerned about "trophy hunters" searching for the next security vulnerability than the PHP vulnerability itself."I'm more concerned about what comes next. This is just one. There's more to come.""The problem is when you pic.twitter.com/uBSC3VAqzf— TBPN (@tbpn) October 21, 2026The two PHP vulnerabilities, collectively nicknamed “PHP2Shell”, could allow attackers to take control of affected web servers without prior access or authentication. The US National Security Agency and the FBI issued warnings. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” the NSA said.Software supply chains need stronger musclesResearcher Calif.IO used OpenAI’s GPT-5.6 Sol AI model to identify the vulnerabilities. The vulnerabilities had reportedly remained undetected for more than a decade. In other words, AI expedited the discovery process and let humans find software flaws that may or may not have existed for years.Sriram wrote on X, “I think today’s PHP disclosure is a harbinger of things to come. these models will make us all safer by finding long lurking issues. However, the entire software supply chain will need the muscles to rapidly build and deploy fixes. We might need a lot more public + private partnerships to secure infrastructure across the country.”The PHP Foundation released an emergency security update on October 21. Following the release, several government websites in the EU went offline, as organisations installed the update. The Wikimedia Foundation also took down several systems as a precaution, affecting access to parts of Wikipedia.Cloudflare CEO Matthew Prince said exploitation attempts rose from thousands before the announcement to millions afterwards. “In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote on X. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”- Ends