Critical security vulnerabilities in PHP pose widespread risks across the internet

Two critical security vulnerabilities have been identified in the PHP programming language, affecting all versions from the last 20 years. Rated 9.2 out of 10, these flaws allow attackers to execute malicious code remotely on vulnerable systems. Amazon Threat Intelligence reported that attack attempts began days before security patches were released.

The vulnerabilities target the PHP infrastructure used by approximately 70 percent of websites. Popular platforms such as Wikipedia, WordPress, Drupal, DeviantArt, and 4Chan went offline temporarily as a security precaution. The Internet Archive also underwent a similar process, and it is noted that some systems running on older technologies face the risk of permanent shutdown due to the inability to update.

Cloudflare CEO Matthew Prince stated that they observed thousands of attack attempts in the 10 hours before the vulnerability was announced, and hundreds of thousands in the two hours following the announcement. PHP Foundation Executive Director Elizabeth Barron emphasized that while no successful remote code execution attempts have been detected so far, updating systems is mandatory. The vulnerabilities were discovered by a researcher using the GPT-5.6 Sol artificial intelligence model.