The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
Context & Ripple Effects
The PHP development team had signaled two 9.2-rated vulnerabilities on October 20; researchers identified them as RCE flaws. The Foundation then released fixes early after CVE identifiers began circulating, turning patch deployment into an immediate operational issue.
PHP’s security release says the flaws affect web request-serving installations and urges users to update. The split between supported and legacy versions makes vendor maintenance policy part of the response, not merely an upgrade preference.
First-order effects
- Operators on PHP 8.2 and newer can apply the official fixes for the two unauthenticated RCE flaws, while legacy deployments must obtain remediation from their third-party vendors.
- Third-party vendors supporting older PHP installations face immediate pressure to ship compatible patches or leave customers without a Foundation-provided fix.
Second-order effects
- Organizations running legacy PHP face a sharper choice between waiting on vendor support and accelerating migration to a supported release, concentrating operational demand on vendors with active maintenance capacity.
- Application hosts and service providers must inventory web-facing PHP workloads by version, because the exposure described by PHP applies to installations serving web requests rather than only to isolated development environments.
Third-order effects
- The episode makes version support windows a security boundary: ecosystems with long-lived deployments increasingly shift vulnerability-response responsibility from core maintainers to downstream vendors.
- If vendors cannot sustain timely backports, buyers are likely to treat supported-runtime status as a procurement and hosting requirement rather than a routine software-upgrade concern.
The trend: Critical flaws in widely deployed infrastructure are making lifecycle support and downstream patch distribution central components of ecosystem cyber defense.
Related: Ecosystem cyber defense · RCE · The PHP Foundation · PHP releases security fixes for critical RCE vulnerabilities · PHP Foundation explains its early security release
Related Coverage
- Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ Financial Times
- Critical Flaws Found in PHP, the Language Behind 70% of the Web Seoul Economic Daily · Park Yun-Seon
- Impact of PHP vulnerabilities on Wikimedia tools and services Diff
- AI uncovers massive flaw in web's foundational code Axios · Sam Sabin
- Millions of websites at risk? OpenAI finds critical security flaws in PHP, here is all you need to know Digit · Ayushi Jain
- Korea Raises Cyber Alert Level Over Critical PHP Flaws Seoul Economic Daily · Cho Yun-Jin
- Impact of PHP vulnerabilities on Wikimedia Cloud Services Diff
- Global tech firms, govt agencies rush to contain critical PHP security flaws The Hans India · Ians
- UK working to identify exposure after global cyber-security warning BBC · Helen Sullivan
- PHP security flaws explained: Affected versions, how to fix and more details Digit · Ayushi Jain
- Read This Website While You Still Can The Atlantic · Matteo Wong
- Google Cloud Warns of Critical PHP Flaws Affecting Millions of Websites Windows Report · Milan Stanojevic
- PHP developers issue new version to fix critical vulnerabilities Reuters · Kanjyik Ghosh
- Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack Futurism · Frank Landymore
- PHP: The three letters that shut down sites all over the internet today The Verge
- Canadian government sites among those offline after flaw identified in widely used computer language CBC News · Abby Hughes
- PHP security flaws alarm Korean government, companies The Korea Times · Nam Hyun-woo
- ‘Backbone of the web’: What is PHP and how has it raised AI hacking fears? France 24
- Government Issues Cyber Crisis “Caution” Alert Over PHP Security Flaw... Security Firms Respond The Asia Business Daily · Lee Eunseo
- Websites go dark as AI exposes critical security flaws Oman Observer
- Websites across the world taken down to protect systems as critical cyber-security update issued The Independent · Maira Butt
- Google Cloud advises customers to patch PHP flaws Tech in Asia · Diya Lal
- AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack Fortune · Emily Forlini
- PHP security alert: What US and Indian government warnings mean for websites The Indian Express · Bijin Jose
- AI-detected PHP security flaws disrupt websites, spark warnings across Asia Nikkei Asia
- 3 reasons Wikipedia, hospitals and government sites went dark today TheStreet · Neo
- Websites close as owners scramble to fix cybersecurity flaws Telegraph
- Hackers Launch Mass Attacks on Websites Through Two Vulnerabilities in PHP—the Language That Powers Most Websites Stories Framing the Globe
- “Shutting Down Because We Can't Fix It”: Critical PHP Vulnerability Sparks Aftershocks in Japanese Game Industry Inven Global
- Websites taken down worldwide as critical cyber-security update issued BBC
- What is PHP and how has it raised hacking fears? RTÉ
- 110,000 Korean Servers Exposed to Critical PHP Flaws Seoul Economic Daily
- ‘We expect mass attacks to start within 15 minutes of the release’: Web admins braced for emergency PHP updates to plug leaked high-severity holes PC Gamer · Andy Edser
- How worried should we be about the PHP cybersecurity crisis? Metro.co.uk · Josh Milton
- Hackers Race to Exploit Newly Found PHP Vulnerabilities Worldwide Bitcoin Insider
- Google Cloud Warns of Critical PHP Vulnerabilities Affecting Millions of Websites Windows Report · Milan Stanojevic
- Usage statistics of PHP for websites W3Techs
- Critical security issue affecting PHP National Cyber Security Centre
- There isn't an easy exploit for this PHP vulnerability Elias Taylor
- PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out Decrypt · Jose Antonio Lanz
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) SOPHOS
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you Daily Mail · Wiliam Hunter
- Upcoming Critical PHP Security Release PHP
- CZ Warns Crypto Users to Be “Extra Careful”: PHP Vulnerabilities Hit the Code Behind 70% of Websites Coinspeaker · Daniel Francis
- Governments, companies rush to fix PHP-related flaws Daily Sabah
- Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond CNBC · Jenny Lee
- The entire internet is officially in crisis mode Polygon.com · Patricia Hernandez
- PHP's development team plans to release patches on Wednesday at 10am ET to fix two vulnerabilities, each rated 9.2; watchTowr researchers say they are RCE flaws BleepingComputer · Lawrence Abrams
- A report claims exploit tool PHP2Shell enables RCE on PHP sites; watchTowr says two vulnerabilities affect every version since PHP 5, which was released in 2004 Ars Technica · Dan Goodin
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- Websites scramble to fix software flaw that could put much of internet at risk Washington Post
- Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore's cybersecurity chief The Business Times
- The Day the Internet Was Almost Hacked RedState · Ben Smith
- PHP security flaw: Websites taken down as OpenAI spots issue with backbone of internet The National · Cody Combs
- Websites shut down globally as PHP flaws trigger millions of attack attempts Türkiye Today
- Binance founder CZ warns crypto users over critical PHP security flaws crypto.news · Rony Roy
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- Why did huge swathes of the internet suddenly go offline yesterday? The Irish Times · Stephen Conneely
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- PHP security flaws trigger global scramble; CERT-In flags critical vulnerabilities Times of India · Shilpa Phadnis
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- There's an internet-wide security crisis, but crypto might actually be ahead of the curve Yahoo Finance
- Firms Race to Fix Widespread Cyber Flaw Before Hackers Break In Bloomberg · Ryan Gallagher
- Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws Korea JoongAng Daily · Sung Ji-Won
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- Firms Race to Fix Widespread Cyber Flaw Before Hackers Break In Bloomberg Law · Ryan Gallagher
- 2026 PHP Vulnerability / Hack Know Your Meme · Phillip Hamilton
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- What to know about the AI-detected security bug impacting wide swaths of the internet Livemint
- PHP flaws draw millions of hacking attempts amid global push for fixes FCW · David DiMolfetta
- The race to fix huge PHP code flaw at the heart of the internet - The Latest The Guardian
Discussion
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@mattburgess1
Matt Burgess
on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...