Major Security Flaw in PHP Language Affects Millions of Websites

A serious security problem has been discovered in the PHP programming language, causing many websites across the internet to shut down. PHP is a foundational tool used to build websites, and according to W3Techs, it powers nearly 70 percent of all websites where the server-side language is known. Because so many sites rely on it, the discovery of two major bugs has created a global security concern.

The vulnerabilities, which have been named PHP2Shell, allow hackers to perform what is known as "unauthenticated remote code execution." This means a person can run their own computer code on a website’s server, change its content, or steal stored data without needing an administrator password. According to The Verge, the PHP Group confirmed that these flaws make almost any site running PHP potentially at risk.

While these bugs have existed in the code for about 20 years, they were previously very difficult to find. Security firm Wiz noted that exploiting them required a complex series of steps that was almost impossible for humans to manage. However, the situation changed when artificial intelligence was used to study the code. OpenAI reported that an AI security group discovered the flaws using a model called GPT-5.6 Sol, and Google-owned Wiz also found them independently using AI tools.

The impact has been widespread. As reported by The Verge, major platforms like Wikipedia, 4chan, and DeviantArt have been affected. Even gaming services like Pokémon Home and Pokémon Champions were taken offline. The issue is so serious that government agencies in the Netherlands and Finland decided to turn off their websites to stay safe. Furthermore, the NSA Cybersecurity account and the UK’s National Cyber Security Center recommended that organizations take their systems offline if they could not update them immediately.

Ars Technica reports that PHP maintainers are preparing to release two emergency patches to fix these issues. These patches are highly important because both vulnerabilities have been given a severity rating of 9.2 out of 10. The maintainers have asked website administrators to prepare for these updates as soon as they become available. They also warned that they might release the fixes earlier if evidence of active attacks appears.

There is some debate about why this was not discovered sooner. The PHP Foundation stated that one of the vulnerabilities was theorized in 2024, but no clear evidence was found at the time, and other technical issues were considered more important. However, the security firm watchTowr confirmed that the vulnerabilities affect every version of PHP released since 2004. Because of this, security experts are calling this one of the most severe problems in the history of web software.

For the average internet user, the technical details—such as "RCE via OOM corruption"—might sound confusing. Essentially, these terms describe how the memory in a server can be tricked into processing bad data as if it were correct. This allows the attacker to take control of the server's processes. The CTO of Cloudflare noted that they were already seeing early attacks, which highlights the urgency of the situation.

As the world waits for the official patches, the internet remains in a state of high alert. Organizations are working quickly to secure their systems and protect user data. This event serves as a reminder of how much of the modern internet depends on a few core technologies, and how quickly that landscape can change when new vulnerabilities are exposed by advanced technology like AI.