PHP: The three little letters wreaking havoc across the web

<figure> <img alt="Cybersecurity illustration by Carlo Cadenas." data-caption="" data-portal-copyright="Illustration by Carlo Cadenas / The Verge" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/2025/04/VRG_ILLO_STK001_carlo_cadenas_cybersecurity_virus.jpg?quality=90&#038;strip=all&#038;crop=0,0,100,100" /> <figcaption> </figcaption> </figure> <p class="wp-block-paragraph">Two vulnerabilities found in the programming language PHP put <a href="https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026">enormous swaths of the internet in danger</a>.</p> <p class="wp-block-paragraph">By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were <a href="https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress">temporarily shut down</a> after the vulnerabilities were disclosed. Even governments weren&#8217;t immune.</p> <p class="wp-block-paragraph">But it&#8217;s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some <a href="https://www.theverge.com/tech/1016545/two-old-school-japanese-mobile-games-are-shutting-down-over-the-php-exploit">older sites and services</a> that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.</p> <p class="wp-block-paragraph">Here&#8217;s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”</p> <ul> <li> <a href="https://www.theverge.com/tech/1016545/two-old-school-japanese-mobile-games-are-shutting-down-over-the-php-exploit">Two old-school Japanese mobile games are shutting down over the PHP exploit.</a> </li> <li> <a href="https://www.theverge.com/tech/1016408/the-php2shell-exploit-hit-cloudflare-hard">The PHP2Shell exploit hit Cloudflare hard.</a> </li> <li> <a href="https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026">PHP: The three letters that shut down sites all over the internet today</a> </li> <li> <a href="https://www.theverge.com/tech/1015481/gpt-5-6-sol-was-used-to-identify-critical-php-flaw">GPT‑5.6 Sol was used to identify critical PHP flaw.</a> </li> <li> <a href="https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress">A critical PHP vulnerability may take websites down today</a> </li> </ul>