Money came only after the crisis. After Heartbleed, a dozen companies each pledged $100,000 a year for three years through the Core Infrastructure Initiative, and two OpenSSL developers became full-time.
Back to the trend of the day: Two PHP flaws let strangers seize websites; some went offline for safety
Poly Rating · from the trend of the day
Worst Internet Security Flaws: Log4j, Heartbleed, PHP 2026
Before Heartbleed, the encryption library behind a large share of the web's HTTPS servers ran on about $2,000 a year in donations, and seven years later Log4Shell, rated a perfect 10, was attacked at least eight days before its public advisory.
- No. 1: Log4Shell (Log4j, CVE-2021-44228)
- 10 places
01Final list
The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.
Order: from most to least AI agreement.
A bright badge means this AI put the entry on its list. A dim badge means it did not.
- 1
Log4Shell (Log4j, CVE-2021-44228)
Perfect 10.0 with no password needed. Attacked from 1 Dec 2021, eight days before the advisory. Unpaid maintainers: sources say 3 or 16 volunteers.
Included it: Claude, Meta, Nemotron, Gemini. Did not include: ChatGPT, Grok, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 1 · Meta: 1 · Nemotron: 6 · Gemini: 1
What each AI noted 4
- Claudeplace 1
Cloudflare saw a successful exploit on 1 Dec 2021, at least nine days before the public advisory, and the code was kept up by a volunteer team that Apache's foundation did not pay.
Source ↗ - Metaplace 1
Perfect 10.0 CVSS, 400k exploit attempts in 2 days, 30% still vulnerable after 60 days, fixed by 16 unpaid volunteers
Source ↗ - Nemotronplace 6
Duplicate entry; see rank 1.
Source ↗ - Geminiplace 1
A single line of text in a free logging package run by three unpaid volunteers exposed an estimated three billion devices across the world's largest cloud providers.
Source ↗
4 AIs put it here - 2
Heartbleed (OpenSSL, CVE-2014-0160)
Scored only 5.0 (v2) or 7.5 (v3), yet it leaked private keys. About 600,000 servers were vulnerable, and about 300,000 still were two months later. OpenSSL ran on about $2,000 a year.
Included it: Claude, Meta, Nemotron, Gemini. Did not include: ChatGPT, Grok, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 2 · Meta: 2 · Nemotron: 2 · Gemini: 2
What each AI noted 4
- Claudeplace 2
CISA only put it in its exploited-vulnerabilities list on 4 May 2022, eight years after the fix, and before the crisis the foundation behind OpenSSL reportedly had one full-time employee and about $2,000 a year in donations.
Source ↗ - Metaplace 2
600k servers initially vulnerable, 309,197 still leaking memory after 2 months, OpenSSL had $2,000 yearly donations and 4 volunteers
Source ↗ - Nemotronplace 2
CVSS 7.5 but exposed private keys of ~17% of HTTPS sites; exploited within hours; patching took months for many; OpenSSL had ~4 core developers, <$1M/yr funding.
- Geminiplace 2
A cryptographic library protecting two-thirds of the world's encrypted web servers was kept alive on roughly $2,000 a year in donations by a single full-time maintainer.
4 AIs put it here - 3
Shellshock (GNU Bash, CVE-2014-6271)
Rated 10.0 (v2) and attacked within hours of disclosure. The bug sat in a shell kept up mainly by one maintainer, Chet Ramey. CISA only listed it in 2022.
Included it: Claude, Meta, Nemotron, Gemini. Did not include: ChatGPT, Grok, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 3 · Meta: 4 · Nemotron: 4 · Gemini: 4
What each AI noted 4
- Claudeplace 3
A bug in the shell that runs behind countless web servers was attacked within hours of disclosure, yet CISA only listed it in January 2022.
- Metaplace 4
25-year-old bug since 1989 in Bash on every Linux and Mac, CVSS 10.0, first in-the-wild attacks within 24 hours
Source ↗ - Nemotronplace 4
CVSS 10.0 in Bash; unauthenticated RCE via environment variables; exploited within days; patching fragmented across Unix-like systems; Bash maintained by ~2 volunteers, minimal funding.
- Geminiplace 4
A silent command execution flaw lay dormant for 22 years in the default Unix shell that essentially one programmer had maintained since 1989.
4 AIs put it here - 4
PHP2Shell (PHP, CVE-2026-109618 and CVE-2026-109619)
Two unauthenticated remote-code flaws (9.2 on v4.0; 9.8 on v3.1 by one report). Whether attacks are confirmed is disputed, and they were not in KEV as of 21 Oct.
Included it: Claude, Meta, Nemotron, Gemini. Did not include: ChatGPT, Grok, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 4 · Meta: 3 · Nemotron: 3 · Gemini: 5
What each AI noted 4
- Claudeplace 4
A leaked tip moved the fix up by a day, and about 884,000 hosts still reported PHP 8.1 or older, a version line that gets no official fix.
Source ↗ - Metaplace 3
69.3% of identifiable web sites run PHP, attacks started 4 days before fix, flaws leaked Oct 20 ahead of Oct 21 patch
Source ↗ - Nemotronplace 3
Two critical flaws (CVSS 9.8) in PHP's CGI mode allow unauthenticated RCE; attacks seen before patch; ~78% of web runs PHP; core team ~10 volunteers, ~$200k/yr.
Source ↗ - Geminiplace 5
A double memory corruption flaw in the engine powering over 75% of global websites forced emergency weekend patches and prompted government agencies across Europe to take portals offline.
4 AIs put it here - 5
XZ Utils backdoor (CVE-2024-3094)
Rated 10.0, but this was a planted backdoor, not a bug. It took two years of trust-building on a lone maintainer and was caught by a half-second SSH slowdown before wide rollout.
Included it: Claude, Meta, Gemini. Did not include: ChatGPT, Grok, Nemotron, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 5 · Meta: 5 · Gemini: 3
What each AI noted 3
- Claudeplace 5
A years-long takeover of a one-maintainer project was caught by chance by one engineer before reaching most stable Linux releases.
Source ↗ - Metaplace 5
Intentional backdoor after 2-year grooming of exhausted volunteer, CVSS 10.0, caught by 500ms SSH latency anomaly weeks before stable release
Source ↗ - Geminiplace 3
A multi-year covert operation targeted the psychological exhaustion of a lone, unpaid maintainer in Finland to plant a master key directly into Linux SSH logins.
Source ↗
3 AIs put it here - 6
Spring4Shell (Spring Framework, CVE-2022-22965)
Rated 9.8 with an exploit public within 24 hours, and CISA listed it four days after disclosure. Unlike most here, the project had corporate (VMware) backing.
Included it: Claude, Meta, Nemotron. Did not include: ChatGPT, Grok, Gemini, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 9 · Meta: 8 · Nemotron: 7
What each AI noted 3
- Claudeplace 9
Dubbed the successor to Log4Shell, it reached CISA's list on 4 April 2022 with a 21-day deadline.
Source ↗ - Metaplace 8
CVSS 9.8 RCE in Spring MVC/WebFlux on JDK 9+, exploit public within 24h, Spring powers millions of enterprise Java apps
Source ↗ - Nemotronplace 7
CVSS 9.8 in Spring Framework; unauthenticated RCE via data binding; exploited within days; widespread in enterprise Java; Spring team ~20 engineers, funded by VMware/Tanzu.
Source ↗
3 AIs put it here - 7
GHOST (glibc, CVE-2015-0235)
A heap overflow present in nearly every Linux system since 2000. AIs give its score as 10.0 (v2), 9.8 or 7.5, and fixing it meant restarting every network service.
Included it: Meta, Nemotron, Gemini. Did not include: Claude, ChatGPT, Grok, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Meta: 7 · Nemotron: 10 · Gemini: 9
What each AI noted 3
- Metaplace 7
Heap overflow in gethostbyname since glibc 2.2 in 2000, CVSS 10.0, affects virtually every Linux system, patch lag 15 years
Source ↗ - Nemotronplace 10
CVSS 7.5 in glibc gethostbyname; unauthenticated RCE via DNS; exploited within days; patching across Linux distros fragmented; glibc maintained by ~10 volunteers, funded by Red Hat/others.
- Geminiplace 9
A buffer overflow in the core GNU C resolver function quietly underwrote almost every connected Linux application from 2000 until 2015.
3 AIs put it here - 8
Apache Struts / Equifax (CVE-2017-5638)
Exploit code appeared the day after the March 2017 patch. Equifax still lost data on 146.6 million people (another source says 147.9 million) to one unpatched server.
Included it: Claude, Meta. Did not include: ChatGPT, Grok, Nemotron, Gemini, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 7 · Meta: 6
What each AI noted 2
2 AIs put it here - 9
React2Shell (React Server Components, CVE-2025-55182)
Rated 10.0 and needed one request. Exposed IPs in Shadowserver's scans rose from 77,664 to over 137,200 in a week, and 30+ organisations were breached (one source).
Included it: Claude. Did not include: ChatGPT, Meta, Grok, Nemotron, Gemini, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 6
What each AI noted 1
- Claudeplace 6
One crafted web request was enough, and the number of exposed IP addresses in Shadowserver's scans rose from 77,664 to over 137,200 in a week.
Source ↗
1 AIs put it here - 10
PHP-CGI argument injection (CVE-2024-4577)
PHP's previous emergency. A ransomware gang used it about 2 days after the June 2024 fixes, and about 250,000 Windows PHP servers were exposed (one vendor's estimate).
Included it: Claude. Did not include: ChatGPT, Meta, Grok, Nemotron, Gemini, StepFun, Kimi, DeepSeek, Wenxin.In their lists: Claude: 8
What each AI noted 1
- Claudeplace 8
Windows 'best-fit' character conversion let strangers run code, and a ransomware gang used it within days of the June 2024 fixes.
Source ↗
1 AIs put it here
02Worth knowing
What the AIs noticed while building the list.
CISA added Heartbleed to its exploited list in May 2022, eight years after the fix. KEV dates show when the list was built, not when attacks began.
The XZ backdoor moved from accidental bugs to social engineering. An operator spent about two years gaining commit rights by 'helping' an exhausted lone maintainer.
How many volunteers kept Log4j going is disputed: 16 unpaid volunteers per InfoWorld and Help Net Security, about 3 per other answers. A year later, maintainer Ralph Goers still worked on it unpaid, beside two full-time jobs.
PHP's share of the web is quoted as 69.3% (W3Techs, 21 Oct 2026, sites with a known server language) and as 76-78% in other answers. Either way, a flaw in PHP core reaches more sites than a WordPress or Drupal bug.
03How we counted
In plain words, no formulas.
1The question
Top 10 Flaws in the Internet's Hidden Foundations, From Heartbleed to Today's PHP Emergency
2Why this topic
It places today's PHP flaws in the same line as Heartbleed, Shellshock and Log4Shell, and sets attack speed against patch speed, which no single list does.
3Where it applies
Global; open-source software that much of the internet depends on
4What we looked at
- Severity score, and whether a stranger could take control without a password
- Days from disclosure to confirmed attacks
- Time until most exposed servers were patched worldwide
- Size and funding of the volunteer team that maintained the software
- NIST National Vulnerability Database (NVD) — CVSS severity scores and whether a flaw can be used without a password
- CISA Known Exploited Vulnerabilities (KEV) catalog — Confirmed real-world attacks, the date CISA listed each flaw, and the federal patch deadline
- Shadowserver Foundation scans (as reported by BleepingComputer) — Internet-exposed IPs still running vulnerable code after a fix
- Censys retrospective on Log4j — Share of internet hosts that still looked vulnerable to Log4Shell over time
5Who ranked
The leading AIs, each building its own list of ten independently and naming a source for every place: Claude, ChatGPT, Meta, Grok, Nemotron, Gemini, StepFun, Kimi, DeepSeek, Wenxin.
6How the places were set
The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.
04Each AI's own list
🇺🇸 Claude10 places · 4 notes
The same question, answered by Claude alone. The final list above combines all the AIs.
- 1Log4Shell (Apache Log4j, CVE-2021-44228, 2021)
Cloudflare saw a successful exploit on 1 Dec 2021, at least nine days before the public advisory, and the code was kept up by a volunteer team that Apache's foundation did not pay.
Source ↗ - 2Heartbleed (OpenSSL, CVE-2014-0160, 2014)
CISA only put it in its exploited-vulnerabilities list on 4 May 2022, eight years after the fix, and before the crisis the foundation behind OpenSSL reportedly had one full-time employee and about $2,000 a year in donations.
Source ↗ - 3Shellshock (GNU Bash, CVE-2014-6271, 2014)
A bug in the shell that runs behind countless web servers was attacked within hours of disclosure, yet CISA only listed it in January 2022.
- 4PHP2Shell (PHP, CVE-2026-109618 and CVE-2026-109619, October 2026)
A leaked tip moved the fix up by a day, and about 884,000 hosts still reported PHP 8.1 or older, a version line that gets no official fix.
Source ↗ - 5XZ Utils backdoor (CVE-2024-3094, 2024)
A years-long takeover of a one-maintainer project was caught by chance by one engineer before reaching most stable Linux releases.
Source ↗ - 6React2Shell (React Server Components, CVE-2025-55182, December 2025)
One crafted web request was enough, and the number of exposed IP addresses in Shadowserver's scans rose from 77,664 to over 137,200 in a week.
Source ↗ - 7Apache Struts / Equifax (CVE-2017-5638, 2017)
A patch shipped on 6 March 2017, exploit code appeared the next day, and Equifax still lost data on 146.6 million people.
Source ↗ - 8PHP-CGI argument injection (CVE-2024-4577, 2024)
Windows 'best-fit' character conversion let strangers run code, and a ransomware gang used it within days of the June 2024 fixes.
Source ↗ - 9Spring4Shell (Spring Framework, CVE-2022-22965, 2022)
Dubbed the successor to Log4Shell, it reached CISA's list on 4 April 2022 with a 21-day deadline.
Source ↗ - 10Drupalgeddon2 (Drupal core, CVE-2018-7600, 2018)
A Drupal remote code execution that was still being added to CISA's must-patch list in November 2021, more than three years later.
Source ↗
What Claude noticed
CISA added Heartbleed to its exploited-vulnerabilities list in May 2022, eight years after the bug was fixed. The KEV dates reflect when the list was built, not when attacks began, so they are a poor clock for 2014-era flaws.
Heartbleed's NVD score was only 5.0 (CVSS v2) because the old scoring method counted impact on the host, yet it exposed passwords and private keys. Log4Shell scored 10.0, and the project that maintained it had 16 unpaid volunteers.
Money came after the crisis. After Heartbleed, a dozen companies pledged $100,000 a year each for three years through the Core Infrastructure Initiative, and two OpenSSL developers became full-time.
A year after Log4Shell, Ralph Goers was reported to still hold two full-time jobs with Log4j as the unpaid one (Spanish-language report). His GitHub Sponsors count rose from 3 to 31.
🇺🇸 Meta10 places · 4 notes
The same question, answered by Meta alone. The final list above combines all the AIs.
- 1Log4Shell (Log4j) CVE-2021-44228 – 2021
Perfect 10.0 CVSS, 400k exploit attempts in 2 days, 30% still vulnerable after 60 days, fixed by 16 unpaid volunteers
Source ↗ - 2Heartbleed (OpenSSL) CVE-2014-0160 – 2014
600k servers initially vulnerable, 309,197 still leaking memory after 2 months, OpenSSL had $2,000 yearly donations and 4 volunteers
Source ↗ - 3PHP2Shell (PHP) CVE-2026-109618 and CVE-2026-109619 – 2026
69.3% of identifiable web sites run PHP, attacks started 4 days before fix, flaws leaked Oct 20 ahead of Oct 21 patch
Source ↗ - 4Shellshock (Bash) CVE-2014-6271 – 2014
25-year-old bug since 1989 in Bash on every Linux and Mac, CVSS 10.0, first in-the-wild attacks within 24 hours
Source ↗ - 5XZ Utils backdoor CVE-2024-3094 – 2024
Intentional backdoor after 2-year grooming of exhausted volunteer, CVSS 10.0, caught by 500ms SSH latency anomaly weeks before stable release
Source ↗ - 6Apache Struts Equifax CVE-2017-5638 – 2017
One unpatched Struts instance led to 147.9M people breached, patch available Mar 7 2017, exploited Mar 2017, Equifax breached May-July
Source ↗ - 7GHOST glibc CVE-2015-0235 – 2015
Heap overflow in gethostbyname since glibc 2.2 in 2000, CVSS 10.0, affects virtually every Linux system, patch lag 15 years
Source ↗ - 8Spring4Shell (Spring Framework) CVE-2022-22965 – 2022
CVSS 9.8 RCE in Spring MVC/WebFlux on JDK 9+, exploit public within 24h, Spring powers millions of enterprise Java apps
Source ↗ - 9Text4Shell (Apache Commons Text) CVE-2022-42889 – 2022
CVSS 9.8 copy of Log4Shell pattern in variable interpolation, exploitation seen Oct 18 just 5 days after disclosure Oct 13
Source ↗ - 10cURL SOCKS5 heap overflow CVE-2023-38545 – 2023
CVSS 9.8 worst cURL flaw ever per maintainer Daniel Stenberg, cURL present on billions of devices, phones, cars, servers
Source ↗
What Meta noticed
PHP still powers 69.3% of websites where server language is known as of Oct 21 2026 – so two bugs in PHP core expose more sites than a bug in WordPress or Drupal alone
OpenSSL had about $2,000 in yearly donations and 4 volunteers when Heartbleed leaked private keys from 17% of trusted HTTPS servers
Log4j is maintained by 16 unpaid volunteers – researchers found 30% of Log4j instances still vulnerable 2 months after the CVSS 10.0 disclosure
XZ backdoor took 2 years of trust-building by Jia Tan to become co-maintainer – caught only because SSH logins were 500ms slower, weeks before it would have reached Debian stable and Red Hat
🇺🇸 Nemotron10 places · 1 notes
The same question, answered by Nemotron alone. The final list above combines all the AIs.
- 1Log4Shell (CVE-2021-44228, 2021)
CVSS 10.0, unauthenticated RCE in ubiquitous Java logging library; exploited within hours, millions of servers still unpatched months later; maintained by ~3 volunteers on <$100k/yr.
- 2Heartbleed (CVE-2014-0160, 2014)
CVSS 7.5 but exposed private keys of ~17% of HTTPS sites; exploited within hours; patching took months for many; OpenSSL had ~4 core developers, <$1M/yr funding.
- 3PHP CGI Argument Injection (CVE-2026-XXXXX, 2026)
Two critical flaws (CVSS 9.8) in PHP's CGI mode allow unauthenticated RCE; attacks seen before patch; ~78% of web runs PHP; core team ~10 volunteers, ~$200k/yr.
Source ↗ - 4Shellshock (CVE-2014-6271, 2014)
CVSS 10.0 in Bash; unauthenticated RCE via environment variables; exploited within days; patching fragmented across Unix-like systems; Bash maintained by ~2 volunteers, minimal funding.
- 5EternalBlue / WannaCry (CVE-2017-0144, 2017)
CVSS 8.1 in SMBv1; wormable, no auth needed; exploited globally within weeks of leak; patching slow due to legacy Windows; Microsoft well-funded but users delayed.
- 6Log4j 2.x (CVE-2021-44228) — already ranked #1
Duplicate entry; see rank 1.
Source ↗ - 7Spring4Shell (CVE-2022-22965, 2022)
CVSS 9.8 in Spring Framework; unauthenticated RCE via data binding; exploited within days; widespread in enterprise Java; Spring team ~20 engineers, funded by VMware/Tanzu.
Source ↗ - 8ProxyLogon (CVE-2021-26855, 2021)
CVSS 9.8 in Microsoft Exchange; unauthenticated SSRF leading to RCE; exploited by nation-state before patch; patching slow due to on-prem complexity; Microsoft well-funded.
Source ↗ - 9BlueKeep (CVE-2019-0708, 2019)
CVSS 9.8 in RDP; wormable, pre-auth RCE; exploited months later; patching slow on legacy Windows; Microsoft funded but user inertia.
Source ↗ - 10GHOST (CVE-2015-0235, 2015)
CVSS 7.5 in glibc gethostbyname; unauthenticated RCE via DNS; exploited within days; patching across Linux distros fragmented; glibc maintained by ~10 volunteers, funded by Red Hat/others.
What Nemotron noticed
The 2026 PHP emergency is the first time a language runtime used by ~78% of websites (W3Techs) had a pre-auth RCE with active exploitation before patch release.
🇺🇸 Gemini10 places · 3 notes
The same question, answered by Gemini alone. The final list above combines all the AIs.
- 1Log4Shell (CVE-2021-44228)
A single line of text in a free logging package run by three unpaid volunteers exposed an estimated three billion devices across the world's largest cloud providers.
Source ↗ - 2Heartbleed (CVE-2014-0160)
A cryptographic library protecting two-thirds of the world's encrypted web servers was kept alive on roughly $2,000 a year in donations by a single full-time maintainer.
- 3XZ Utils Backdoor (CVE-2024-3094)
A multi-year covert operation targeted the psychological exhaustion of a lone, unpaid maintainer in Finland to plant a master key directly into Linux SSH logins.
Source ↗ - 4Shellshock (CVE-2014-6271)
A silent command execution flaw lay dormant for 22 years in the default Unix shell that essentially one programmer had maintained since 1989.
- 5PHP2Shell (CVE-2026-109618 & CVE-2026-109619)
A double memory corruption flaw in the engine powering over 75% of global websites forced emergency weekend patches and prompted government agencies across Europe to take portals offline.
- 6RegreSSHion (CVE-2024-6387)
An unauthenticated remote root race condition resurrected a patched 2006 bug inside the cryptographic doorway safeguarding 14 million public servers.
Source ↗ - 7Kaminsky DNS Cache Poisoning (CVE-2008-1447)
A fundamental math vulnerability in the open-source DNS protocol let strangers redirect any domain name silently, triggering the first secret multi-vendor summit in history.
- 8Exim Return of the WIZard (CVE-2019-10149)
Over 57% of the internet's public mail transfer relays relied on an academic volunteer software engine where an unauthenticated flaw yielded instant remote root execution.
Source ↗ - 9GHOST in glibc (CVE-2015-0235)
A buffer overflow in the core GNU C resolver function quietly underwrote almost every connected Linux application from 2000 until 2015.
- 10Apache HTTP Server Path Traversal (CVE-2021-41773 & CVE-2021-42013)
A subtle logic error in URL path normalization compromised the web server that pioneered the commercial internet, weaponized across millions of hosts inside 24 hours.
What Gemini noticed
The entire secure web in 2014 rested on OpenSSL's budget of just $2,000 in yearly tips, compelling major technology corporations to form the multi-million dollar Core Infrastructure Initiative to audit volunteer dependencies.
The XZ Utils incident represented an evolution from accidental coding bugs to human social engineering, where an operative spent over two years earning commit rights by helping an exhausted, isolated volunteer maintainer.
The emergency October 2026 PHP vulnerabilities (PHP2Shell) underscore that foundational script runtimes driving more than three out of every four websites still rely on legacy memory models where single defects require instant infrastructure intervention.