Decades-old PHP bugs threaten broad swaths of the internet
Security researchers have disclosed two PHP flaws that could affect a large share of the web, with sites such as Wikipedia, WordPress, Drupal, DeviantArt, and 4chan impacted. Because the bug reaches back roughly two decades, older unsupported services may be impossible to patch and could shut down permanently. The Internet Archive briefly went offline, and Cloudflare reported a heavy impact.
Security firm Wiz described the flaws as exceptionally serious, and reporting indicates AI helped uncover them. Because the defects span about two decades of PHP releases, many legacy sites cannot simply install a fix; some older services may disappear for good.
The disruption spread beyond blogs and forums. The Internet Archive recovered after a brief outage, Cloudflare observed attack attempts climb from thousands to millions, and Dutch and Finnish government sites plus Pokémon services were taken offline as precautions. Two long-running Japanese mobile games announced closures.
The fallout could affect ordinary internet users through outages of familiar sites and loss of access to older community archives. Organizations running unsupported PHP may face hard choices between costly migration and permanent closure, while attackers may exploit unpatched systems at scale. Governments and critical services may need to take precautions, and the incident may accelerate moves toward maintained software and contingency planning.