Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.
By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.
But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.
Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”
The disastrous PHP vulnerabilities were exploited days before the patch
Photo by Amelia Holowaty Krales / The VergeHackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer.
On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices. Elizabeth Barron, the PHP Foundation’s executive director, tells The Verge that “to our knowledge, there has been no successful attempt at remote code execution” but stresses that updating affected systems is “imperative.”
Read Article >- The Internet Archive was briefly forced offline because of PHP.
The list of sites that had to go down, at least temporarily, because of the recently disclosed PHP vulnerability keeps growing. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online. Digital librarian Brewster Kahle posted his thanks on Mastodon last night: “Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems.“
- Two old-school Japanese mobile games are shutting down over the PHP exploit.
World Quest and Save My Demonic World have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the apocalyptic PHP exploit disclosed this week. Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost. Per Kotaku:
Many old websites and services that are no longer being actively updated (or may simply be too old to receive the update, as was the case for these two games) are now at risk of permanently going offline. Such an event would lock swathes of the old internet from public view, including bits that were already beginning to break down and become inaccessible.
- The PHP2Shell exploit hit Cloudflare hard.
CEO Matthew Prince says the company saw thousands of attempts to exploit the PHP vulnerability across the Cloudflare network in the 10 hours before the issue was publicly announced. That jumped to “hundreds of thousands” of attacks in the 2 hours after the disclosure, and “millions” by last night. Yikes.
Matthew Prince 🌥 (@eastdakota) on X[X (formerly Twitter)]
PHP: The three letters that shut down sites all over the internet today
Photo by Amelia Holowaty Krales / The VergeTwo bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center. Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports.
The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.
Read Article >- GPT‑5.6 Sol was used to identify critical PHP flaw.
OpenAI says a security researcher at Calif used GPT-5.6 Sol to identify PHP exploits before attackers did, and has shared a tool that lets developers check if they’re using a potentially vulnerable version of PHP that needs patching. Ami Luttwak, co-founder of Google’s Wiz security team that also helped to identidy the PHP2Shell exploit, told the Wall Street Journal that its “the most severe AI vulnerability that was ever found.”
A critical PHP vulnerability may take websites down today
This PHP issue sounds like a pretty huge problem. Illustration by Carlo Cadenas / The VergeSecurity patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.
The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.
Read Article >
