---
title: Every PHP server from the last decade just got owned...
link: https://www.youtube.com/watch?v=SMGg7iisHmc
source: youtube-com-fireship
published: 2026-10-23T18:19:58Z
updated: 2026-10-23T18:22:48Z
first_seen: 2026-10-23T18:40:08.262074691Z
authors:
- Fireship
summary: |-
  Semgrep Guardian catches the risky code and packages your agent introduces. Try it free for 60 days: https://semgrep.dev/onboarding/guardian?offer=fireship_202610&utm_source=fireship&utm_medium=referral&utm_campaign=2026-10_fireship_guardian_campaign

  PHP2Shell, a backdoored Python package with 23 million weekly downloads, a GitLab bug dating back to 2014, rogue AI agents inside bank accounts, and a certificate authority generating HTTPS keys from numbers under 256 — let's break down the craziest week in the history of the internet.

  Want more Fireship?

  🗞️ Newsletter: https://bytes.dev
  🧠 Courses: https://fireship.dev
content: extracted
html: 2026-10-23-every-php-server-from-the-last-decade-just-got-owned.html
remote_preview:
  url: https://i4.ytimg.com/vi/SMGg7iisHmc/hqdefault.jpg
extra:
  thumbnail: https://i4.ytimg.com/vi/SMGg7iisHmc/hqdefault.jpg
---

Semgrep Guardian catches the risky code and packages your agent introduces. Try it free for 60 days: https://semgrep.dev/onboarding/guardian?offer=fireship_202610&utm_source=fireship&utm_medium=referral&utm_campaign=2026-10_fireship_guardian_campaign

PHP2Shell, a backdoored Python package with 23 million weekly downloads, a GitLab bug dating back to 2014, rogue AI agents inside bank accounts, and a certificate authority generating HTTPS keys from numbers under 256 — let's break down the craziest week in the history of the internet.

Want more Fireship?

🗞️ Newsletter: https://bytes.dev\
🧠 Courses: https://fireship.dev