Critical PHP Vulnerabilities Disrupt Websites Worldwide
Two critical vulnerabilities in PHP have triggered an urgent response across the web, with major websites, online services, and government agencies either patching their systems or temporarily taking them offline as a precaution.
PHP powers widely used platforms including WordPress, Wikipedia, and Drupal. The vulnerabilities were assigned a severity rating of 9.2 out of 10, and the PHP Foundation released security patches intended to address both flaws. Cybersecurity authorities, including the UK’s National Cyber Security Center and the NSA, advised organizations whose systems could not be updated immediately to consider taking them offline.
The impact was already visible in shutdowns affecting 4chan, DeviantArt, Wikipedia, and several Dutch and Finnish government agencies. The Internet Archive and other services also experienced disruption. Pokémon Home and older Japanese mobile games were among the services affected by the security issue.
Remediation is more complicated than updating a current PHP installation. The vulnerabilities reportedly extend to PHP versions dating back roughly 20 years, including releases that are no longer supported. Site operators still running those versions may have limited options other than upgrading through a supported release or permanently discontinuing their services.
The flaws were identified with the help of AI, according to reporting on the discovery. Their broad reach illustrates how a vulnerability in a foundational software layer can quickly affect much of the internet when long-lived installations, hosted platforms, and aging services are left unpatched.