Two critical vulnerabilities in PHP have triggered urgent patching and precautionary shutdowns across the web. The programming language is used by major platforms and countless smaller sites, so the risks reach beyond the services that first made headlines.
A widely used system faces an urgent fix
PHP underpins sites and services including Wikipedia, WordPress, and Drupal. Some accounts estimate that up to 70 percent of websites use PHP in some capacity. After the vulnerabilities were disclosed, DeviantArt and 4Chan were temporarily shut down, while some Dutch and Finnish government agencies took their sites offline as a precaution.
The vulnerabilities are rated 9.2 out of 10 in severity. Cybersecurity firm watchTowr described them as remote code execution exploits affecting every PHP version from PHP 5 onward. In practical terms, that could let attackers run code on affected servers, potentially altering websites or stealing data.
PHP developers released security patches and urged users to upgrade as soon as the release became available. The UK’s National Cyber Security Center and the NSA Cybersecurity account on X recommended taking systems offline when an immediate update was not feasible.
Why the flaw became a present-day threat
The vulnerabilities have existed for roughly 20 years. According to security firm Wiz, exploiting the underlying issue once required an exceptionally complex chain of steps, near the limits of what human researchers could practically achieve.
Powerful AI models have made it easier to turn obscure bugs into usable exploits. The source reports that a security researcher at Calif used GPT‑5.6 Sol to identify the PHP flaw before attackers did. Wiz also helped identify the exploit, called PHP2Shell.
That shift matters because a long-standing weakness can become much more dangerous when the effort needed to exploit it falls. Websites that once faced a difficult-to-use flaw may now need to respond to a more immediate risk.
Attack attempts surged after disclosure
Cloudflare CEO Matthew Prince said the company saw thousands of attempts to exploit the PHP vulnerability across its network in the 10 hours before public announcement. The number rose to “hundreds of thousands” in the two hours after disclosure, and then to “millions” by last night.
The reported activity helps explain why organizations took sites offline while they assessed whether they could apply the patch. Going offline can interrupt access to a service, but leaving an affected system exposed could give attackers a chance to run code on its server.
Older services face a harder choice
Updating a current server may address the problem, but not every PHP-based service is actively maintained. The flaw reaches across versions dating back roughly 20 years, including releases that are no longer supported. Older sites may have no straightforward path to a patch.
The consequences could include the permanent loss of services and parts of the web’s history. Two Japanese mobile games, World Quest and Save My Demonic World, have run for over a decade, but their developers say their older technology cannot be updated to apply the fix. Both are shutting down over the exploit.
That puts operators in a difficult position: services that cannot be brought up to date may have to close, even when they remain meaningful to their users. As old websites and games disappear, material that was already becoming inaccessible could be lost from public view.
The PHP incident therefore involves more than applying a patch to widely used software. It also exposes how a vulnerability in old, unsupported technology can put active websites and internet history at risk at the same time.