PHP discloses two high-severity vulnerabilities, affecting numerous websites and government sites

Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger .

By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.

But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.

Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”

The list of sites that had to go down , at least temporarily, because of the recently disclosed PHP vulnerability keeps growing. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online. Digital librarian Brewster Kahle posted his thanks on Mastodon last night: “Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems.“

World Quest and Save My Demonic World have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the apocalyptic PHP exploit disclosed this week . Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost. Per Kotaku :

CEO Matthew Prince says the company saw thousands of attempts to exploit the PHP vulnerability across the Cloudflare network in the 10 hours before the issue was publicly announced . That jumped to “hundreds of thousands” of attacks in the 2 hours after the disclosure, and “millions” by last night. Yikes.

Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia , and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center . Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports .

The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz . However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.

OpenAI says a security researcher at Calif used GPT-5.6 Sol to identify PHP exploits before attackers did, and has shared a tool that lets developers check if they’re using a potentially vulnerable version of PHP that needs patching. Ami Luttwak, co-founder of Google’s Wiz security team that also helped to identidy the PHP2Shell exploit, told the Wall Street Journal that its “the most severe AI vulnerability that was ever found.”

Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday , PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.

The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr , the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.