This week's PHP2Shell incident shows why critical open source needs sustained investment at scale. On 21 October, PHP released fixes for two critical vulnerabilities that could, under certain conditions, allow attackers to execute code on affected web servers without authentication. But the incident also shows that finding vulnerabilities only improves security if maintainers have the resources to fix them.

(1/3)