PHP2Shell: A Wake-Up Call to Protect and Fund the Language Powering the Web

 

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities collectively known as PHP2Shell.

Both vulnerabilities carry a severity score of 9.2 out of 10 and could allow attackers to execute malicious code on vulnerable servers without authentication.

Evolve Adoption Planning: Decide What Moves Before You Migrate It

Modernization can go wrong long before the first line of new code is deployed.

The problem is often not whether the new implementation works.

Why Horizontal Scaling Exposes Bad State Management in PHP

Scaling a PHP application across multiple servers sounds simple:

1 server
   ↓
2 servers
   ↓
4 servers

But adding servers does not automatically make an application scalable.

Evolve Bridge: Modernize PHP Without Rewriting Everything

One of the biggest mistakes in legacy modernization is assuming the only clean solution is a full rewrite.

That sounds simple:

Old application
    ↓
Rewrite everything
    ↓
New application

But real systems are rarely that easy.

Evolve Doctor: Is Your PHP Application Ready to Modernize?

Modernizing a PHP application is not only a code problem.

You can clean up classes, separate modules, introduce better boundaries, and design a migration plan—and still hit a wall because the environment underneath the application is not what you expected.

Why Horizontal Scaling Exposes Bad State Management

A PHP application can run perfectly well on one server for years.

Then traffic grows.

You add a second application instance behind a load balancer.

And suddenly strange things start happening.

Users get logged out.

Uploads disappear.

Background jobs cannot find temporary files.

One request sees state created by another server.

Evolve Doctor: What Should You Check Before Modernizing a PHP Application?

In the previous EvolvePHP post, I wrote about Evolve Audit.

Audit approaches an existing PHP application from the outside.

It asks:

“What can we learn about this codebase without running it?”

That is useful, but static evidence only tells part of the story.

At some point, modernization has to deal with the environment in which the application actually runs.

Which PHP version is active?

Are required extensions available?

Are important paths writable?

Are required environment variables present?

Do the assumptions in the project match the machine running it?

That is where I see Evolve Doctor fitting.

Coding Principles That Make PHP Applications Easier to Scale

When people talk about scaling a PHP application, the discussion usually moves quickly toward infrastructure.

Redis.

Queues.

More servers.

Read replicas.

Containers.

Load balancers.

But infrastructure is only one part of the story.

A codebase that is difficult to reason about at small scale usually becomes more expensive to operate at large scale.

That is why I think scalability starts with coding principles long before it becomes an infrastructure problem.

Build for Change, Not for Distribution

A lot of architecture discussions eventually become arguments about deployment models.

Monolith or microservices?

One database or many?

Synchronous or event-driven?

PHP or Go?

Containers or serverless?

Those are useful questions.

But I think they often arrive too early.

The Database Is Often the Hardest Part of Service Extraction

When people talk about extracting a service from a monolith, the conversation often focuses on code.

Move the controller.

Move the business logic.

Create an API.

Deploy it separately.

Done.

Except the difficult part is usually not the code.

It is the data.

You can move code in a day. Untangling data ownership can take months.

That is why I think service extraction should begin with the database question much earlier than most teams expect.