Critical PHP flaws prompt site shutdowns as exploit attempts surge
Original title: PHP: The three little letters wreaking havoc across the web
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
Two critical PHP vulnerabilities, present for roughly 20 years, led sites including 4chan, DeviantArt, Wikipedia and the Internet Archive to go offline at least temporarily. PHP patches were released at 10AM ET after a Tuesday advisory. Cloudflare CEO Matthew Prince said exploit attempts rose from thousands in the 10 hours before disclosure to hundreds of thousands within two hours and millions by that night. A Calif researcher used GPT-5.6 Sol to find the issues before attackers, OpenAI said, and OpenAI shared a version-check tool.
Unconfirmed: The claim that up to 70 percent of websites use PHP is attributed to some accounts, not a measured census.
- Dutch and Finnish agencies and Pokémon Home and Pokémon Champions also went offline.
- World Quest and Save My Demonic World are shutting down because they cannot be patched.
- The NSA and the UK NCSC advised taking systems offline if an update is not immediate.
- The Internet Archive’s operations team patched and restored the site.
- Wiz’s Ami Luttwak called it the most severe AI vulnerability ever found.
Impact: Remote code execution to alter sites or steal data
| Product | Affected |
|---|---|
| PHP | every PHP version from PHP 5 onward |
- 1.Upgrade as soon as the PHP release is available.
- 2.Take systems offline if an immediate update is not feasible.
- 3.Use OpenAI’s tool to check for a vulnerable PHP version.
From the original article
4 min read at theverge.com
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger. By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed.
By Terrence O’Brien · theverge.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.