PHP2Shell became public on October 20, and by the next day every supported branch of PHP had an emergency patch. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each scored 9.2 out of 10 for severity. They let an attacker run code on a server without logging in. Wiz Research took over fresh installs of the latest WordPress, Drupal, and Joomla. It also showed it could read passwords, login tokens, and API keys straight out of server memory. The bugs live in PHP itself, so even a bare “Hello World” page on an affected version was exposed. Working attack code was public within days.
PHP runs roughly 70 percent of the world’s websites. The PHP Foundation, the nonprofit that keeps the language alive, took in $730,534 in donations in 2025 and spent $784,376. It ran a deficit to keep a small team of core developers paid.
Who Pays for the Commons
The foundation’s sponsor list tells you who carries this work. Its largest backer in 2025 was Germany’s Sovereign Tech Agency, a public body funded by German taxpayers. JetBrains, Automattic, GoDaddy, and a long tail of small web agencies and freelancers came next. The Sovereign Tech Agency also paid for PHP’s most recent independent security audit, which the nonprofit OSTIF ran. Amazon, Google, and Microsoft are missing from that top tier. Their cloud platforms host millions of PHP sites and sell the computing power those sites run on.
When the fix arrived, it came from a handful of paid maintainers and volunteers who patched four release branches in about a day. That was fast, skilled work, and it deserves credit. The industry has also learned to expect that kind of work for free. The companies that earn the most from PHP put the least into keeping it safe. When it breaks, the cost lands on every small business, school district, and volunteer webmaster who has to drop everything and patch.
The Detail That Ties It to the Grid
Wiz found the first bug on August 19, 2026. It used its own Wiz Atlas platform alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. The vulnerable code had been in PHP for more than a decade. Turning it into a working attack meant chaining several memory bugs together, then reworking each chain for different PHP versions and server setups. Wiz’s researchers were blunt about what changed: “Pre-AI, this manual work would be difficult to implement and even harder to scale.” Language models now do much of that adapting, testing, and debugging. Anyone with access to them can do the same.
Wiz used these tools to defend and disclosed responsibly, and that matters. But the models that found PHP2Shell are trained and run in the same data centers now drawing gigawatts from regional grids. One industry is building tools that find holes in underfunded public software faster than anyone pays to close them. It is also billing much of its electrical expansion to the public. The code commons and the physical commons of power lines, power plants, and rivers are being drawn down by the same companies in the same way.
The Bill Arrives in the Mail
Virginia shows this most clearly. Data centers made up 28 percent of Dominion Energy’s Virginia electricity sales in 2025, and the utility has 48 gigawatts of data center capacity under contract. To serve that load, Dominion is building more gas plants and delaying coal plant retirements. It has also dropped its 2030 emissions-cut target. Its residential customers saw their bills rise 65.5 percent between 2007 and 2025.
In Maryland, Brandon Shores, the state’s last coal plant, was supposed to close. Instead, under an emergency “reliability-must-run” deal, it and the neighboring H.A. Wagner oil plant are staying open through May 2029. Maryland ratepayers are charged about $180 million a year for it. PJM, the grid operator covering 13 states and Washington, D.C., now wants to extend that deal through 2031. Maryland’s People’s Counsel, David Lapp, represents ratepayers before regulators, and he has been plain about why. The new demand keeping those plants open, he said, is “data center growth — almost entirely outside the state of Maryland.” His office has filed a complaint with federal regulators. It argues that over three years PJM pushed $2 billion in transmission upgrades driven by data centers onto Maryland households. One replacement power line went to Baltimore Gas & Electric without competitive bidding, and its cost has doubled to about $1.5 billion.
Across PJM’s territory, the price utilities pay to guarantee enough power plants for the hottest and coldest days rose roughly tenfold between the 2024–25 and 2026–27 delivery years, reaching $329 per megawatt-day. The Institute for Energy Economics and Financial Analysis estimated that data centers drove 63 percent of the jump in the 2025–26 auction. That share alone added $9.3 billion to customer costs. Households in western Maryland now pay about $18 more a month because of those capacity charges alone.
The pattern holds nationwide. The Environmental and Energy Study Institute counts 15 coal plants whose announced retirements have been postponed. Together they released almost 65 million metric tons of greenhouse gases in 2023. In September 2025, a Department of Energy official told Reuters he expected most of the coal capacity nearing retirement to stay online. Data centers could use as much as 12 percent of all U.S. electricity by 2028. They aren’t the only reason coal plants are staying open, but they are the largest new source of demand. A tech company’s clean-energy pledge does nothing to change what the local utility burns to keep its servers running.
Some state regulators have started pushing back with special rates for very large customers. These require data centers to commit to paying for the power capacity they reserve. That helps, but a 2025 study found that existing rates of this kind don’t cover the cost of new gas plants. If a data center leaves early, families and small businesses still pay for a power plant built to serve someone else.
The Same Pattern on the Farm
Industrial animal agriculture has run this playbook for decades. According to Our World in Data, livestock uses about 77 percent of the world’s farmland, counting both grazing pasture and the cropland grown for feed. It supplies only about 18 percent of the world’s calories and 37 percent of its protein. Most of that land is pasture, but feed crops take a large share of cropland too. Roughly a third of the world’s grain harvest, hundreds of millions of tons each year, goes to feed animals rather than people. The industry draws on public subsidies and public water. It leaves manure runoff and methane for its neighbors to deal with. The animals pay the highest price: creatures that feel pain and fear, raised in confinement and treated as units of output.
Factory farms and hyperscale data centers make very different things, but they rest on the same deal. Land, water, and air are treated as free inputs, and the damage is left for the public to absorb.
Who the Hardware Serves
It’s worth asking what the public is paying to power. In July 2025, the Pentagon’s Chief Digital and Artificial Intelligence Office awarded contracts worth up to $200 million each to Anthropic, Google, OpenAI, and xAI. That doesn’t mean all AI computing serves the military. It does mean the grid upgrades households are paying for help support companies that sell to defense and security agencies. Their tools can easily be turned toward surveillance and border enforcement. Anyone who cares about civil liberties should want public control over how that power is used.
Open-weights models, which anyone can download and run, are part of the answer, though people often overstate how much of one. You can inspect them, audit them, and run them on hardware you control, without sending your data to a company. The smaller ones run well on an ordinary laptop or a modest office server. The largest open models, though, are trained on the same giant clusters as the closed ones. Meta, which releases its Llama models openly, is no cooperative. A real alternative needs both open models and clean power: publicly or cooperatively owned computing, run on renewable energy, serving the people who pay for it.
Making Them Pay
PHP2Shell shows the limits of licensing as a fix. PHP uses a permissive license, and nobody sells “managed PHP” the way Amazon sold managed Elasticsearch. What PHP needs is steady money. Germany’s Sovereign Tech Agency is a working model. It is a public fund that pays for maintenance and security on the open-source code a whole economy depends on. Procurement rules can push the same way. Drupal and WordPress are everywhere across government websites, and any agency or contractor that builds on them should be required to fund the projects underneath.
Licensing matters more for databases and infrastructure tools, where cloud companies can resell community work as a paid service. The GNU Affero General Public License (AGPLv3) closes that gap. If a company modifies AGPL software and lets people use it over a network, it has to offer those users the modified source code. MongoDB’s answer in 2018 was the Server Side Public License (SSPL). It goes much further, requiring any company that offers the software as a cloud service to open-source its entire management system. Elastic adopted it in 2021 and Redis in 2024. Amazon responded by forking Elasticsearch into OpenSearch, which moved to the Linux Foundation in 2024. Redis was forked into Valkey, which the Linux Foundation hosts with backing from Amazon, Google, Oracle, and others.
The SSPL fight was messier than a tale of good maintainers and greedy clouds. The Open Source Initiative never approved SSPL, and the Debian and Fedora Linux distributions dropped MongoDB over it. Much of the criticism came from open-source developers, not just executives. SSPL also puts control in the hands of one company. That company usually owns the copyright to the code outside contributors wrote, because it requires them to sign it over. In 2024 Elastic added AGPL back as an option, and Redis followed in 2025. That retreat says something: AGPL protects the community without handing one corporation the keys. The stronger approach pairs AGPL with public and cooperative funding, so the people who write the code keep both the code and a living wage.
On the grid, Lapp has said what most regulators won’t: “The solution that no one is talking about is telling the data centers no, you can’t connect to the system.” Short of that, a new data center should pay the full cost of the transmission lines and substations it requires. It should bring new clean generation and battery storage that adds to the grid before it is allowed to connect. And it should pay a carbon price on whatever fossil power it still uses. Communities have also owned their power before. Rural electric cooperatives and public utilities already serve tens of millions of Americans. Community solar and municipal storage can be owned the same way. Developers can organize the same way too, through cooperatives and foundations that maintainers govern themselves.
The Ratepayer Coalition
Electric bills are where this becomes local politics. A family in Baltimore County paying for a coal plant kept open to serve data centers in Virginia shares a grievance with a conservation group fighting that plant’s emissions. A farmer watching a server campus draw on the local aquifer shares it too. Ratepayer advocates, environmental groups, and rural landowners rarely work together. A demand that data centers pay their own way gives them common ground.
Clean power also protects household budgets. Wind, solar, and batteries have no fuel cost, so they shield households from the gas price spikes that track wars and export markets. Every gigawatt a data center builds from renewables, instead of drawing it from aging coal and gas plants, is one fewer gigawatt of fuel-price risk passed on to everyone else.
Germany’s taxpayers paid to audit the code that runs a large share of America’s websites, government sites among them. Maryland households are paying to keep a coal plant open for data centers in other states. Which of the companies profiting from both is going to send the first check?
#LibertarianSocialism #ClimateAction #AnimalLiberation #DigitalRights #UniversalHumanRights #DGS #OpenSource #TechCooperatives #GridResilience #CorporateWelfare
Originally published on Substack.
Comments