Tech
PHP: The three little letters wreaking havoc across the web
Reading in data-saving mode. Read full article from The Verge website.
Published 10/22/2026 10:12:27 AM
Everything we know so far about the PHP2Shell vulnerability
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.
By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.
But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.
Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”
One man basically saved the internet from the PHPocalypse.
Charlie Warzel at The Atlantic interviewed Ondřej Surý, the man almost single-handedly responsible for packaging up the patch for this week’s vulnerabilities. It’s a fascinating conversation, from Surý‘s odd nonchalance about saving the web to his concern that for-profit companies are exploiting open-source. But he hopes that this AI-assisted discovery will lead to a change:
… Everything’s moving fast now, and it’s taking a toll on the people who are defending the stuff. At the same time, maybe this is the turning point where we actually start caring about this … I might be wrong, but I’m an optimist that people will finally realize that we can’t go like this forever. This has been a disaster waiting to happen for a really, really long time.
Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer.
On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices. Elizabeth Barron, the PHP Foundation’s executive director, tells The Verge that “to our knowledge, there has been no successful attempt at remote code execution” but stresses that updating affected systems is “imperative.”
Read Article >The Internet Archive was briefly forced offline because of PHP.
The list of sites that had to go down, at least temporarily, because of the recently disclosed PHP vulnerability keeps growing. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online. Digital librarian Brewster Kahle posted his thanks on Mastodon last night: “Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems.“
Two old-school Japanese mobile games are shutting down over the PHP exploit.
World Quest and Save My Demonic World have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the apocalyptic PHP exploitdisclosed this week. Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost. Per Kotaku:
Many old websites and services that are no longer being actively updated (or may simply be too old to receive the update, as was the case for these two games) are now at risk of permanently going offline. Such an event would lock swathes of the old internet from public view, including bits that were already beginning to break down and become inaccessible.
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center. Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports.
The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.
Read Article >Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.
The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.
Read Article >
