PHP2Shell is the biggest security story of the year.

PHP2Shell is the biggest security story of the year.

PHP runs under the hood of nearly 70% of all websites. AI tools from Wiz, Google, and OpenAI independently found bugs that had been sitting in the code for over a decade, with severity scores as high as 9.2 out of 10.

Wiz showed attackers taking over WordPress, Drupal, and Joomla sites without even logging in.

The disclosure leaked early on social media, forcing everyone’s hand. Cloudflare saw thousands of exploit attempts before the announcement, millions after.

Wikimedia took systems offline. The NSA told organizations that can’t patch to go dark.

The key line from Wiz: “Complexity may no longer provide a meaningful barrier.”

For decades, software stayed safe because breaking it was too hard. AI erased that moat. 2026 has already produced 21.7% of every CVE ever published, with ten weeks left in the year.

Bitcoiners saw this coming. The Coldcard drains, Boltz pausing swaps, the BTCPay emergency this summer. The Bitcoin Red Team spun up AI-assisted reviews across hundreds of repos. Now it’s hit the broader web.

Watch for the response. This is a perfect setup for calls to lock down the internet: digital ID to get online, permission slips to run models, only approved companies near the frontier.

Open-source software and open-weight models are what keep defense from becoming a permissioned activity. Defend them.

One email. Every weekday. Bitcoin, macro, AI, and freedom tech. No fluff.

Sign up for The Commoner: https://www.tftc.io/commoner