I love php.

• the php foundation just said they threw mythos and openai models at the code and the only thing they found is a 2 years open discussion about if an OOM can lead into RCE - https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
• responsible disclosure - https://news-web.php.net/php.announce/509
• fast - https://phpbenchlab.com/php-8-5-vs-nodejs-vs-go-vs-python-cpu-benchmark-2026/

I didn't love php2shell.

• it showed me that only a special part of the world has access to cyber capable models
• some people claim RCE on PHP core itself, while crafting scripts which would be RCE on their own
• some people claim RCE on even latest versions without proof (for the fame?)
• it was sleepless nights for me
• it showed how vulnerable legacy software is and how few people are carrying the whole infrastructure

still waiting for a working POC for PHP 5.x

basically a fresh php in a docker where you throw your python / whatever code at it (not handcrafted RCE into the script hosted)