PHP: The three little letters wreaking havoc across the web – The Verge The Verge is about technology and how it makes us feel. Founded in 2011, we offer our audience everything from breaking news to reviews to award-winning features and investigations, on our site, in video, and in podcasts. 2026-10-22T16:49:48+00:00 https://www.theverge.com/rss/stream/1016574 https://platform.theverge.com/wp-content/uploads/sites/2/2025/01/verge-rss-large_80b47e.png?w=150&h=150&crop=1 Emma Roth <![CDATA[The disastrous PHP vulnerabilities were exploited days before the patch]]> https://www.theverge.com/?p=1016798 2026-10-22T12:49:48-04:00 2026-10-22T12:49:48-04:00 Illustration of a computer screen with a blue exclamation point on it and an error box.

Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer.

On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws - CVE-2026-109618 and CVE-2026- …

Read the full story at The Verge.

]]> Terrence O’Brien Jay Peters <![CDATA[PHP: The three letters that shut down sites all over the internet today]]> https://www.theverge.com/?p=1015906 2026-10-22T04:59:33-04:00 2026-10-21T16:36:56-04:00 A number of cursors point toward an unhappy face on a laptop

Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if "an immediate update is not feasible," as did the UK's National Cyber Security Center. Even Pokémon Home and Pokémon C …

Read the full story at The Verge.

]]> Jess Weatherbed <![CDATA[A critical PHP vulnerability may take websites down today]]> https://www.theverge.com/?p=1015257 2026-10-22T11:00:17-04:00 2026-10-21T07:49:17-04:00 Cybersecurity illustration by Carlo Cadenas.
This PHP issue sounds like a pretty huge problem. | Illustration by Carlo Cadenas / The Verge

Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they're unable to apply the fix immediately.

The security patch was released today at 10AM ET, and PHP users are being urged to "upgrade ​as soon as the release is available." According to cy …

Read the full story at The Verge.

]]>