PHP: The three little letters wreaking havoc across the web

Two critical vulnerabilities in PHP, the programming language powering up to 70 percent of websites, have been disclosed, affecting roughly 20 years of PHP versions. The bugs, dubbed PHP2Shell, are remote code execution exploits that could let attackers run malicious code, alter sites, and steal data. The flaw had long required an exceptionally complex chain of steps to exploit, but AI models like GPT-5.6 Sol made it practical for researchers to uncover. Security firm Wiz called it among the most severe vulnerabilities in software history, and the NSA and UK's National Cyber Security Center advised taking systems offline if immediate updates aren't feasible. Cloudflare reported millions of exploit attempts, and services including 4chan, DeviantArt, Wikipedia, Pokémon Home, and two decades-old Japanese mobile games World Quest and Save My Demonic World were taken offline. Patches released at 10AM ET carry a 9.2 out of 10 severity rating, but older, unsupported versions leave many sites with little option but to shut down permanently, threatening swaths of internet history.

(Source：The Verge)