Yesterday the people who maintain a piece of free software you have never heard of released an emergency patch. Roughly 70% of the world's websites run that software. Some European governments took their own sites offline while they installed it.
Today the stocks that went up on the news were security companies. That is the part worth explaining.
What PHP is, and why it is under everything
PHP is a programming language. It was written in 1994 to do something very dull: let a web page change depending on who is looking at it.
Think about what that means. A plain web page is a file that says the same thing to everyone. A page that greets you by name, shows your order history, or displays today's prices has to be assembled fresh each time someone asks for it. Something has to do the assembling, on the server, before the page reaches you. For most of the internet, that something is PHP.
It ended up everywhere because it was free, easy to learn, and arrived early. WordPress is built on it, and WordPress alone powers a large share of all websites. So do enormous numbers of shopping carts, forums, booking systems and small business sites that somebody set up fifteen years ago and has not touched since.
Nobody chose this. It is an accident of history that compounded, and the result is a single piece of thirty-year-old software sitting underneath most of the web.
What was wrong with it
Two flaws, which researchers nicknamed PHP2Shell.
The serious one lets an attacker run their own code on someone else's web server. That is the worst category of software flaw there is, because it stops being about stealing a particular piece of data and becomes about controlling the machine. The second leaks fragments of the server's memory, which can contain passwords, session tokens, API keys and the private cryptographic keys that prove a website is who it says it is.
They were rated 9.2 out of 10 on the standard severity scale. Every server running PHP version 5.4 or later is affected, which is effectively all of them.
The bugs had been sitting in the code for over a decade. According to the researchers, nobody had found or used them in all that time.
That is the detail to sit with. The flaw was not introduced last month. It was always there, in software running most of the internet, and everyone was fine until the moment everyone knew.
The part that is actually new
Here is why this story is different from the hundreds of other software flaws patched this year.
An AI model found one of them.
OpenAI says its model turned it up while systematically reading through open source code looking for weaknesses. Separately, researchers at Wiz found both flaws, using a combination of models from OpenAI and Google to locate and then demonstrate the attacks. The language from both groups was unusually strong. OpenAI called it one of the most impactful security issues in recent memory. The Wiz researchers said the findings rank among the most severe vulnerabilities discovered in PHP, and arguably in the history of software.
A human being could have found these. Human beings had thirty years and did not.
What changed is the cost of looking. Reading an enormous codebase line by line hunting for a subtle memory handling error is exactly the kind of work that is valuable, tedious and effectively unlimited in scope. There is always more code. When the cost of that search falls far enough, work that was never worth doing starts getting done.
This cuts in both directions, and the honest version of the story includes both. The same drop in cost is available to the people looking for flaws in order to use them.
Why the security stocks went up
Now the puzzle, which is the thing most readers will find genuinely confusing.
A catastrophic flaw was announced in software running most of the internet, and on the day it was announced, cybersecurity companies rose. CrowdStrike was up around 6.6%. Cloudflare around 5.5%. Palo Alto Networks around 3.9%. Rapid7, Okta and others moved with them.
A disaster for the internet was a good day for the companies whose business is protecting against it.
The reason is simpler than it looks, and it is not cynicism. A company that filters traffic before it reaches your server can block an attack pattern for every customer at once, without those customers having to patch anything. Cloudflare said its firewall customers were already covered. So the news was not "our customers are in danger." It was "the thing we do just became visibly necessary to everyone who was not doing it."
That is a demand signal, not a damage report.
It is worth being precise about what the market is pricing. Not revenue that arrived. Not a contract that was signed. A changed expectation about how many organisations will decide, over the next year, that they need this. The stock moved on a story about future budgets, which is what almost all one-day stock moves are about, whatever the headline says.
What this does not tell you
It does not tell you anyone was harmed. As of now the researchers say there is no evidence these flaws were ever used. They were found by people looking for them and reported to the maintainers. The severity score measures what an attack could do, not what happened. Those two things get conflated constantly in coverage of security news.
It does not tell you those stocks were correct to rise. A one-day move on a news story is an opinion about future demand, and opinions about future demand are wrong all the time. The same sector has risen on headlines before and given it all back when the budgets did not follow. If you want to know whether this one was right, the place to look is renewal rates and new customer counts in two or three quarters, not the chart today.
And it does not tell you the problem is over. The patch exists for current versions. PHP 8.1 and earlier get no official fix. An enormous number of the sites running PHP are small, old, and maintained by nobody in particular. The patch being available and the patch being installed are separated, in practice, by years.
There is a general lesson underneath this about the difference between a number and the thing it measures. A severity score of 9.2 sounds like a fact about the world. It is a structured opinion about potential, published by a committee, and it is useful precisely because everyone agrees to use the same scale. The same is true of a fair value. Techdamentals produces one by running four separate methods and showing the range they span, because a single number carries a confidence that the underlying estimate does not have.