PHP patches critical flaws enabling remote code execution as sites worldwide go dark

Security patches for PHP rolled out this week to fix two vulnerabilities that PHP's own developers rated 9.2 out of 10 for severity, setting off an emergency response across a huge portion of the web. According to The Verge, the flaws — which the security industry has dubbed PHP2Shell — allow remote code execution, meaning attackers can run their own code on affected servers, alter websites, and steal data.

Two decades of PHP are affected

The cybersecurity firm watchTowr, cited by The Verge, says the vulnerabilities impact every PHP release from PHP 5 onward, a span of roughly 20 years. That long tail is what makes the situation so difficult: many deployments run versions that are no longer supported and will never receive a fix, leaving their operators with few options.

PHP's enormous footprint compounds the problem. By some estimates referenced by The Verge, as much as 70 percent of websites use PHP in some capacity. The language powers WordPress, Drupal, Wikipedia, DeviantArt, and 4chan, among many others, which means any unpatched WordPress blog is potentially in scope alongside some of the most visited sites on the internet.

Sites went dark as a precaution

The disclosure triggered a wave of voluntary shutdowns. The Verge reports that DeviantArt and 4chan were temporarily taken offline after the vulnerabilities were announced, and Wikipedia was affected as well. Government agencies in the Netherlands and Finland pulled their sites down as a precaution, and Pokémon Home and Pokémon Champions were taken offline, according to Kotaku.

The Internet Archive was also briefly forced offline, though its operations team patched and restored service quickly. Digital librarian Brewster Kahle thanked responders on Mastodon, noting how much worse the night could have gone, according to The Verge.

The US NSA's cybersecurity account and the UK's National Cyber Security Center both advised organizations to take systems offline if they could not apply the update immediately, an unusually blunt recommendation that underscores the severity.

Attack attempts surged after disclosure

Cloudflare CEO Matthew Prince shared numbers illustrating how quickly attackers mobilized, as reported by The Verge. The company saw thousands of attempts to exploit the PHP vulnerability across its network in the ten hours before the issue was publicly announced. That climbed to hundreds of thousands of attacks within two hours of disclosure, and reached millions by the following night.

An AI-assisted discovery

The vulnerabilities were not newly introduced; they have been present in PHP for roughly two decades. Security firm Wiz explained that exploiting them previously demanded an exploit chain so intricate it sat at the boundary of what human researchers could realistically accomplish, but modern AI models made it far easier to convert the obscure bugs into working attacks.

OpenAI says a security researcher at Calif used GPT-5.6 Sol to identify the PHP exploits before attackers did, and OpenAI has released a tool that lets developers check whether they are running a vulnerable PHP version. Ami Luttwak, co-founder of Wiz, which also helped identify the exploit, told the Wall Street Journal that it is the most severe vulnerability ever found with AI assistance. Wiz has separately described the flaws as among the most severe ever discovered in software history.

Some sites will not come back

While most large platforms will patch and return, some will not. Kotaku reports that two long-running Japanese mobile games, World Quest and Save My Demonic World, are shutting down permanently because they are built on older technology that cannot be updated. The Verge notes that because the vulnerability affects nearly 20 years of PHP releases, large portions of internet history that are no longer actively maintained now risk being lost from public view.

Why it matters

This is one of the rare security events that touches essentially the entire web at once. PHP quietly underpins a majority of websites, and a remote code execution flaw spanning two decades of releases means the patch gap between disclosure and update is a window of extreme exposure, as Cloudflare's attack numbers show. It also marks a turning point for AI in security: the same capability that let defenders find and fix the bugs first can be turned toward discovering and weaponizing them. Finally, the permanent closure of services that cannot be patched is a preview of how unmaintained software becomes a form of digital decay, taking pieces of internet history offline with it.