Two newly discovered flaws in the PHP programming language have placed a huge portion of the internet at risk. Estimates suggest that as many as 70 percent of websites rely on PHP in some form, from major platforms such as Wikipedia, WordPress and Drupal to community sites like DeviantArt and 4chan. Both of those latter sites were taken offline temporarily after the flaws were made public, and even government‑run services were not spared.
The problem is not limited to the latest releases. The vulnerabilities affect every version of PHP released over roughly the past two decades, many of which are no longer receiving security updates. As a result, older applications that are no longer maintained face a stark choice: invest in costly migrations or shut down permanently.
Security firm Wiz described the bugs as “among the most severe vulnerabilities discovered … in software history.” The race to patch the issue has produced a string of notable incidents:
– Attackers began exploiting the PHP flaws days before an official fix was available.
– The Internet Archive experienced a brief outage after the vulnerabilities were leveraged against its infrastructure.
– Two legacy Japanese mobile games announced they would close because they could not protect themselves from the PHP exploit.
– The PHP2Shell attack chain caused significant disruption for Cloudflare customers.
– The three letters “PHP” have become synonymous with site shutdowns across the web today.
– Researchers used the GPT‑5.6 Sol model to pinpoint the critical weakness in the code.
– Experts warned that the vulnerability could bring down additional websites at any moment.
With the patch now released, administrators are urged to update every PHP installation, regardless of age, to mitigate the risk and keep their services online.