The PHP2Shell vulnerability is one of the biggest of all time, in terms of severity (it's a full RCE) and prevalence. PHP is probably the most distributed server side technologies. Wordpress alone is like 40% of all websites. Log4Shell in 2022 is probably the closest to this one. That was a CVSS 10.0 and was a flaw in a widely distributed Java library. It was used by the Iranians to infiltrate US federal agencies to install Monero miners on their machines and harvest credentials. PHP2Shell is going to be interesting because it's one of the biggest we've had in the open source AI era. Normally, you get a bit of time, from patch to active exploit distributing amongst black hats. At 2pm UTC today the patch for PHP2Shell will be released and it will likely be minutes before viable exploits are produced. And you won't need to be a nation state threat actor to utilise it. It could be anyone with a prompt. So, not only will we find more of these deep critical bugs in core infra. The blast radius is going to be far higher, and the time to respond far lower. Since this is a deep server side vuln, I wouldn't be surprised to see a big jump it botnet activity as people capture vulnerable machines all over the place. It's going to be an interesting few days in cybersecurity.