PHP: The three letters that shut down sites all over the internet today

<figure> <img alt="A number of cursors point toward an unhappy face on a laptop" data-caption="" data-portal-copyright="Photo by Amelia Holowaty Krales / The Verge" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/chorus/uploads/chorus_asset/file/23318433/akrales_220309_4977_0182.jpg?quality=90&#038;strip=all&#038;crop=0,0,100,100" /> <figcaption> </figcaption> </figure> <p class="wp-block-paragraph">Two bugs found with AI are behind major issues today for 4chan, DeviantArt, <a href="https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services/">Wikipedia</a>, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X <a href="https://x.com/NSACyber/status/2112903220209098897">recommended that</a> organizations take their systems offline if "an immediate update is not feasible," as did the UK's <a href="https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php">National Cyber Security Center</a>. Even <em>Pok&eacute;mon Home</em> and <em>Pok&eacute;mon C …</em></p> <p><a href="https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026">Read the full story at The Verge.</a></p>