Home/Events/Critical PHP Vulnerabilities Discovered Affecting Major Websites

Critical PHP Vulnerabilities Discovered Affecting Major Websites

Developing
Confidence
80%
Impact: 90%
Updated 6m ago

Consensus Brief

Two critical vulnerabilities in the PHP programming language have been disclosed, affecting up to 70% of websites, including major platforms like Wikipedia and WordPress. The vulnerabilities, which have existed for roughly 20 years, could allow attackers to execute remote code on affected servers. Security patches have been released, but many older sites remain at risk due to lack of updates.

Sourced from
Primary: The Verge

What Changed Since Last Update

6m ago

New corroborating source added: The Verge published an update on 2026-10-22 ("PHP: The three little letters wreaking havoc across the web").

Claim Ledger

4 claims tracked across sources

Confirmed Fact

Up to 70 percent of websites use PHP in some capacity.

Confirmed Fact

The vulnerabilities have a severity rating of 9.2 out of 10.

Confirmed Fact

PHP2Shell exploit led to hundreds of thousands of attacks in a short period.

Confirmed Fact

The vulnerabilities affect every PHP version from PHP 5 onward.

Role-Based Impact Analysis