Two critical vulnerabilities in the PHP programming language have put a large share of the internet at risk, and security patches began rolling out today at 10AM ET. By some estimates, as many as 70 percent of websites rely on PHP in some form, including Wikipedia, WordPress, Drupal, DeviantArt and 4Chan. PHP developers published an advisory on Tuesday rating the flaws 9.2 out of a possible 10, and some cybersecurity agencies have urged sites that cannot apply the fix immediately to take their systems offline.
The flaws are Remote Code Execution exploits affecting every PHP version from PHP 5 onward, according to security firm watchTowr. Attackers who exploit them could run their own code on affected servers and use that access to alter websites and steal data. The vulnerability has existed in PHP for roughly 20 years, spanning many versions that are no longer supported, which leaves older sites and services that are not actively maintained with few options beyond shutting down permanently.
The outages have spread across consumer and government sites alike. 4Chan and DeviantArt were temporarily shut down after the vulnerabilities were disclosed, and the Internet Archive’s operations team patched, secured and brought its systems back online. Digital librarian Brewster Kahle thanked the many organizations that responded, saying on Mastodon that the situation could have meant no lights and no traffic signals. Some Dutch and Finnish government agencies took their sites down as a precaution, and Pokémon Home and Pokémon Champions were also taken offline, according to Kotaku.
The two online games World Quest and Save My Demonic World have run for over a decade but are built on older technology their developers say cannot be updated to patch the exploit. Kotaku reported that such sites risk going offline permanently, which would put large portions of internet history out of public view. The NSA Cybersecurity account on X and the UK’s National Cyber Security Center both recommended that organizations take systems offline if an immediate update is not feasible.
Cloudflare CEO Matthew Prince said the company saw thousands of attempts to exploit the vulnerability across its network in the 10 hours before the issue was publicly announced. That rose to hundreds of thousands of attacks in the two hours after disclosure and millions by last night.
Security firm Wiz described the flaws as among the most severe vulnerabilities discovered in software history. Wiz said exploiting them had required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve, but powerful AI models have made it far easier to turn the obscure bug into a dangerous vulnerability. OpenAI said a security researcher at Calif used GPT-5.6 Sol to identify the PHP exploits before attackers did, and it has shared a tool that lets developers check whether they are running a potentially vulnerable version that needs patching. Ami Luttwak, co-founder of Google’s Wiz security team, which also helped identify the PHP2Shell exploit, told the Wall Street Journal it is the most severe AI vulnerability ever found.
More cybersecurity news from TechManNews.
