Two critical vulnerabilities in the PHP programming language, present in versions going back roughly 20 years, have put huge parts of the web at risk, forcing sites such as DeviantArt and 4Chan temporarily offline and leaving older, unmaintained services facing permanent closure.
The flaws affect PHP, which by some accounts powers up to 70 percent of websites, including Wikipedia, WordPress and Drupal. The Internet Archive was also briefly forced offline. Even government sites were not immune, according to The Verge.
Security firm Wiz described the issue as "among the most severe vulnerabilities discovered ... in software history." Since the vulnerability exists in every PHP version dating back about two decades, many installations no longer receive security updates, meaning some older sites and services that are no longer actively maintained have little choice but to shut down permanently. Two old-school Japanese mobile games are already closing because of the exploit.
Cloudflare was hit hard by a related exploit called PHP2Shell, underscoring that even major infrastructure providers are vulnerable. The Verge also reports the critical flaw was identified with the help of the AI model GPT-5.6 Sol.
The full scope of the impact is still emerging, but security researchers warn that the wide reach of PHP means the fallout could continue for some time.
Analysis
Why This Matters
- The PHP flaws could expose a large share of the web, since by some accounts 70 percent of sites rely on the language.
- Unsupported legacy versions leave older services with no patch available, risking permanent shutdowns.
- Already, major platforms and at least one infrastructure provider have experienced outages or disruptions.
Background
PHP is one of the oldest and most widely used server-side languages on the web, underpinning popular platforms such as WordPress, Drupal and Wikipedia. The reported flaws reach back roughly 20 years, so they affect both modern deployments and long-abandoned systems. Many older installations no longer receive official support, leaving operators with difficult decisions about whether to keep running exposed software or take services offline.
Key Perspectives
Security researchers: Wiz has called the vulnerabilities among the most severe in software history, a warning that reflects the broad exposure created by a single widely used language.
Site operators: Operators of unmaintained sites face a stark choice: continue running vulnerable software or close permanently, a decision already made by at least two Japanese mobile games.
Infrastructure providers: Cloudflare's apparent exposure to the PHP2Shell exploit shows that even businesses built to defend the web can be caught by the flaws, and their response will affect many downstream customers.
What to Watch
- Further site closures or temporary outages as administrators patch or take systems offline.
- Details on how Cloudflare and other providers mitigate the PHP2Shell exploit.
- Whether the incident accelerates the retirement of unsupported PHP versions across the industry.
