Critical PHP Flaws Threaten 70% of Web, Forcing Legacy Sites to Close
Security firm Wiz identified two critical vulnerabilities in PHP, a language powering up to 70% of websites, including Wikipedia and WordPress. The flaws affect versions dating back 20 years, leaving unsupported legacy systems at risk. Consequently, long-running services like World Quest and Save My Demonic World are shutting down because they cannot update their infrastructure. This event highlights the fragility of the web’s foundational software, potentially causing permanent loss of digital history.
Key points
- Security firm Wiz discovered two critical vulnerabilities in PHP, a programming language used by up to 70% of websites, including major platforms like Wikipedia, WordPress, and Drupal.
- The flaws affect nearly 20 years of PHP versions, meaning many older, unsupported systems remain exposed even after standard updates are applied to current servers.
- Legacy services such as World Quest and Save My Demonic World, which have operated for over a decade, are shutting down because their older technology stacks cannot accommodate the necessary patches.
- Popular sites like DeviantArt and 4Chan were temporarily shut down following the disclosure, while government agencies also faced exposure to the security risks.
- Wiz described the issue as one of the most severe vulnerabilities in software history, warning that unpatched legacy sites may face permanent offline status.
- The situation creates a global challenge for web maintenance, as developers must decide whether to update complex systems or retire services to mitigate security risks.
Security researchers at Wiz have identified two critical vulnerabilities in PHP, the programming language that underpins a significant portion of the global web. Estimates suggest that up to 70% of websites utilize PHP in some capacity, making the discovery a major security event for the internet. High-profile platforms such as Wikipedia, WordPress, Drupal, DeviantArt, and 4Chan rely on the language, and several were temporarily taken offline following the initial disclosure. Even government agencies found themselves exposed to the potential threats posed by these flaws.
The complexity of the issue lies in the age of the affected code. The vulnerabilities exist in versions of PHP dating back approximately 20 years, many of which are no longer actively supported by developers. This legacy burden means that simply updating current servers is insufficient; older, unmaintained sites remain vulnerable. For these legacy systems, the choice is often between a difficult technical overhaul or permanent retirement. Two notable examples are the mobile games World Quest and Save My Demonic World, which have run for over a decade but are now shutting down because their underlying technology cannot be easily patched.
Wiz has characterized the event as one of the most severe vulnerabilities discovered in software history. The implications extend beyond immediate security patches, raising concerns about the preservation of digital history. As developers grapple with the risk of leaving old sites exposed, the web faces a potential wave of closures for services that have been online for years. This situation underscores the long-term maintenance challenges inherent in the internet’s foundational infrastructure.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
