Critical PHP Vulnerabilities Threaten the Web Infrastructure

Two critical vulnerabilities discovered in the PHP programming language threaten to compromise vast portions of the internet.

By various estimates, up to 70% of websites utilize PHP to some degree. It powers major platforms such as Wikipedia, WordPress, Drupal, DeviantArt, and 4Chan, which were temporarily taken offline following the disclosure of these flaws. Even government websites were affected.

However, remedying the issue is not straightforward. The vulnerability exists in every version of PHP dating back approximately 20 years, many of which are no longer supported. This means older, unmaintained sites face the risk of permanent closure.

Security firm Wiz has described these issues as "among the most severe vulnerabilities discovered ... in software history." Notably, two long-running games, World Quest and Save My Demonic World, have shut down because their developers cannot update the outdated technology to patch the "apocalyptic PHP exploit."

The threat to internet history is significant. As Kotaku notes, these old websites and services are at risk of disappearing permanently. This would effectively lock away large sections of the "old internet" that were already becoming inaccessible.

Cloudflare CEO Matthew Prince reported a surge in exploitation attempts. In the 10 hours before the announcement, there were "thousands" of attacks. This number jumped to "hundreds of thousands" within two hours after disclosure and reached "millions" by last night.

Two bugs involving AI are responsible for the major disruptions affecting 4Chan, DeviantArt, Wikipedia, and various blogs. These "critical vulnerabilities" reside in PHP, which underpins many popular sites like WordPress. The Dutch and Finnish governments took their sites offline as a precaution. The NSA and the UK's National Cyber Security Center recommended that organizations take systems offline if an immediate update is not possible. Furthermore, Pokémon Home and Pokémon Champions were reportedly taken offline, according to Kotaku.

The vulnerability has existed for roughly 20 years. Wiz noted that exploiting it previously required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." However, powerful AI models have simplified this process, making it easier to turn obscure bugs into dangerous vulnerabilities.

OpenAI stated that a security researcher used GPT-5.6 Sol to identify PHP exploits before attackers did. The company has shared a tool for developers to check if their version of PHP is vulnerable. Ami Luttwak, co-founder of Google's Wiz security team, told the Wall Street Journal that this is "the most severe AI vulnerability that was ever found."

PHP developers released security patches today to address two critical vulnerabilities that could devastate the internet. In a Tuesday advisory, the vulnerabilities were rated 9.2 out of 10. Agencies advised websites to temporarily go offline if they cannot apply the fix immediately.

Patch availability was announced at 10 AM ET. Users are urged to "upgrade as soon as the release is available." WatchTowr reports these are Remote Code Execution exploits impacting every PHP version from 5 onward, allowing attackers to run malicious code and steal data.