PHP2Shell exposes the funding gap in open-source security

On 21 October 2026, the PHP project released fixes for two critical security vulnerabilities, collectively known as PHP2Shell. In 2024, the Sovereign Tech Agency funded the first external security audit of PHP’s core in over a decade, coordinated by OSTIF and conducted by Quarkslab. The audit identified 17 security-related findings and contributed to subsequent work on the underlying problem behind one of the PHP2Shell vulnerabilities. AI is dramatically accelerating discovery, for security researchers and attackers alike, but fixing a complex flaw still takes deep knowledge of the code, time, and the capacity to make difficult decisions. Both PHP2Shell flaws involve memory safety, an area where the Sovereign Tech Agency and Germany's Federal Office for Information Security (BSI) recently endorsed a European call for action. Through the Sovereign Tech Resilience program, the Sovereign Tech Agency also supports preventative security work, including helping critical open-source projects transition towards memory-safe technologies.