Two vulnerabilities discovered in the PHP programming language place a significant portion of the internet at risk. According to some accounts, up to 70 percent of websites utilize PHP in some capacity. The language powers major platforms including Wikipedia, WordPress, and Drupal, as well as popular sites like DeviantArt and 4Chan. Both DeviantArt and 4Chan were temporarily shut down following the disclosure of the security flaws.
The issue is not limited to recent software versions. The vulnerabilities exist in every version of PHP dating back approximately 20 years. Because many of these older versions are no longer supported, sites and services that are not actively maintained face a critical threat. These unmaintained services may have no option but to shut down permanently. Even government entities were not immune to the risk.
Security firm Wiz described the flaws as among the most severe vulnerabilities discovered in software history. The PHP2Shell exploit specifically impacted Cloudflare. Additionally, two old-school Japanese mobile games are shutting down due to the exploit. GPT-5.6 Sol was used to identify a critical PHP flaw, and a critical vulnerability may take websites down today.