PHP: The three little letters wreaking havoc across the web

# PHP: The three little letters wreaking havoc across the web Source: [https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down](https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down) Two vulnerabilities found in the programming language PHP put[enormous swaths of the internet in danger](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026)\. By some accounts, up to 70 percent of websites use PHP in some capacity\. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were[temporarily shut down](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)after the vulnerabilities were disclosed\. Even governments weren’t immune\. But it’s not as simple as updating a few servers\. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported\. That means some[older sites and services](https://www.theverge.com/tech/1016545/two-old-school-japanese-mobile-games-are-shutting-down-over-the-php-exploit)that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down\. Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history\.” -  The Internet Archive was briefly forced offline because of PHP\. The[list of sites](https://www.theverge.com/tech/1016545/two-old-school-japanese-mobile-games-are-shutting-down-over-the-php-exploit)that had to[go down](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026), at least temporarily, because of the recently disclosed PHP vulnerability keeps growing\. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online\. Digital librarian Brewster Kahle[posted his thanks on Mastodon](https://mastodon.archive.org/@brewsterkahle/117481215431503956)last night: “Given the severity, there are heroes in many many orgs from last night\. Could have been no lights, no traffic signals, real problems\.“ -  Two old\-school Japanese mobile games are shutting down over the PHP exploit\. *World Quest*and*Save My Demonic World*have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the[apocalyptic PHP exploit](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026)[disclosed this week](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)\. Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost\. Per*[Kotaku](https://kotaku.com/two-of-japans-oldest-mobile-games-have-been-forced-permanently-offline-because-of-the-new-exploit-ravaging-the-web-2000748511)*: > Many old websites and services that are no longer being actively updated \(or may simply be too old to receive the update, as was the case for these two games\) are now at risk of permanently going offline\. Such an event would lock swathes of the old internet from public view, including bits that were already beginning to break down and become inaccessible\. -  The PHP2Shell exploit hit Cloudflare hard\. [CEO Matthew Prince](https://x.com/eastdakota/status/2113079352682570051)says the company saw thousands of attempts to exploit the[PHP vulnerability](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026)across the Cloudflare network in the 10 hours before the issue was[publicly announced](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)\. That jumped to “hundreds of thousands” of attacks in the 2 hours after the disclosure, and “millions” by last night\. Yikes\. -  ## [PHP: The three letters that shut down sites all over the internet today](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026)   Photo by Amelia Holowaty Krales / The Verge Two bugs found with AI are behind major issues today for 4chan, DeviantArt,[Wikipedia](https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services/), and the blog where the bar around the corner posts pictures of people’s dogs\. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress\. But it’s far bigger than that\. Some Dutch and Finnish government agencies took their sites down as a precaution\. The NSA Cybersecurity account on X[recommended that](https://x.com/NSACyber/status/2112903220209098897)organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s[National Cyber Security Center](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)\. Even*Pokémon Home*and*Pokémon Champions*were taken offline,[*Kotaku*reports](https://kotaku.com/pokemon-home-sleep-champions-offline-php-cyber-attack-2000748338)\. The vulnerability isn’t exactly new\. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm[Wiz](https://www.wiz.io/blog/php2shell-php-rce)\. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities\. [Read Article \>](https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026) -  GPT‑5\.6 Sol was used to identify critical PHP flaw\. OpenAI says a security researcher at Calif used GPT\-5\.6 Sol to identify[PHP exploits](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)before attackers did, and has[shared a tool](https://github.com/openai/php2shell-checker)that lets developers check if they’re using a potentially vulnerable version of PHP that needs patching\. Ami Luttwak, co\-founder of Google’s Wiz security team that also helped to identidy the PHP2Shell exploit, told the*[Wall Street Journal](https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=rss_Technology)*that its “the most severe AI vulnerability that was ever found\.” -  ## [A critical PHP vulnerability may take websites down today](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)   Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked\. In an[advisory published on Tuesday](https://www.php.net/archive/2026.php#2026-10-20-1), PHP developers said the vulnerabilities have a severity rating of 9\.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately\. The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade ​as soon as the release is available\.” According to[cybersecurity firm watchTowr](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/), the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more\. [Read Article \>](https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress)