A PHP Bug Just Took Websites Offline Worldwide

Highlights

• Two critical PHP vulnerabilities scored 9.2 out of 10 and allow remote code execution without requiring authentication.

• Major global services including 4chan, Wikimedia components, and national login portals went offline after cybersecurity agencies recommended disconnecting unpatched systems.

• Cloudflare deployed preemptive firewall rules at 3am UTC on Wednesday, mitigating exploitation attempts across its network.

• Scans indicate that 59% of servers run PHP version 8.1 or older, creating long-term exposure risks since older versions require manual builds for patches.

• AI-assisted vulnerability discovery allowed researchers to turn a theoretical bug class into a working exploit within a week instead of months.

Timeline

1. 00:00 - 01:30

   The Threat and Global Response

   Cyber agencies worldwide advised organizations to take websites offline if they could not immediately patch their PHP installations. Major platforms, including 4chan and parts of Wikimedia, experienced downtime. Unlike application-level plugins, this flaw resides within the PHP language itself, requiring direct updates to PHP rather than individual web applications.

   • Two critical PHP vulnerabilities dubbed php2 shell received a severity score of 9.2 out of 10.
   • The vulnerability occurs when a request exhausts PHP memory at a specific moment, leaving half-built data that subsequent requests can exploit for remote code execution.
   • The flaw affects every PHP version from the past decade across platforms like WordPress, Drupal, and Joomla.
2. 01:30 - 03:23

   Disclosure Chaos and Emergency Shutdowns

   The coordinated disclosure timeline collapsed after early leaks on Hacker News and premature image publishing by Chainguard. In response, national login services, parliamentary websites, and high-profile forums deliberately shut down operations to await official patches, marking a rare mass offline event for infrastructure administrators.

   • CVE numbers leaked prematurely on Hacker News with incorrect severity ratings, forcing an early disclosure rollout.
   • Chaotic early releases included a mistakenly published exploit video and Chainguard publishing patched PHP images six hours ahead of schedule.
   • Government agencies including the NSA, CISA, the FBI, and the UK's NCSC urged organizations to take vulnerable systems offline.
3. 03:23 - 04:27

   Mitigation and the Long-Tail Risk

   Preemptive CDN firewall deployment prevented massive automated compromises, though attackers quickly adjusted payloads to test defenses. While proper official patches focused on version 8.2 and newer, maintainers like Andre Suri provided backported fixes for Debian and Ubuntu servers down to version 7.4 to address the heavy legacy server footprint.

   • Cloudflare and Vercel deployed automated firewall rules ahead of time, successfully blocking incoming exploit payloads.
   • Watchtower and CISA reported no widespread successful exploitations, limiting immediate damage primarily to deliberate system shutdowns.
   • Security scans revealed that 59 percent of servers run PHP version 8.1 or older, which lacks standard official releases and poses long-term risks.
4. 04:27 - 07:00

   AI Acceleration and Future Security Implications

   The rapid translation of theoretical vulnerabilities into functional exploits highlighted systemic changes in software security. Concurrent breaches, such as an incident at Railway involving leaked environment variables, point to broader targeting of infrastructure platforms. Industry experts note that traditional disclosure models designed for human-paced discovery no longer function effectively in an environment dominated by AI-accelerated vulnerability analysis.

   • OpenAI and Wiz credited AI tools including GPT 5.6 Sol and Gemini 4 Argon with contributing to the rapid identification and patching process.
   • AI tools condensed a process that typically requires months of expert team research into a single week.
   • Traditional vulnerability disclosure frameworks are rendered obsolete by the speed at which AI agents can generate functional exploits from old theoretical foundations.