Wikipedia and 70% of the Internet at Risk After Critical Security Flaw

A critical security vulnerability in PHP, a programming language used by millions of websites, has raised concerns about the security of internet infrastructure worldwide. The vulnerability could expose websites running affected software versions to remote code execution, potentially allowing attackers to execute unauthorized commands on vulnerable servers.

The security warning has drawn attention to websites built with popular platforms such as WordPress, Drupal and MediaWiki, the software that powers Wikipedia. However, the warning that 70% of the internet is at risk does not mean that 70% of websites have been hacked. The actual risk depends on the software version, server configuration and whether the necessary security updates have been installed.

What Is the PHP Security Flaw?

PHP is an open source programming language used to build and operate websites and web applications. It allows websites to process information, interact with databases and deliver dynamic content to visitors. Because PHP is widely used, a vulnerability in the language can potentially affect websites across many industries, including news, retail, education, government and financial services.

The security issue involves vulnerabilities that researchers have associated with the term php2shell. The reported flaws were assigned the identifiers CVE-2026-109618 and CVE-2026-109619. The primary concern is remote code execution, a type of vulnerability that can allow an attacker to make a vulnerable server run unauthorized commands. Depending on the system and the access obtained, an attack could result in stolen information, altered website content, service disruptions or further attacks against connected systems. A vulnerability does not automatically mean a website is compromised. Attackers must be able to exploit the specific weakness, and the level of potential damage depends on the affected system and its security protections.

Why Wikipedia and WordPress Could Be Affected

Wikipedia uses MediaWiki, an open source content management platform built with PHP. WordPress and Drupal also rely on PHP and support websites around the world. This shared technology helps explain why a vulnerability in PHP can create security concerns across numerous websites that otherwise have little in common. The potential problem is the underlying programming language, rather than necessarily a flaw unique to Wikipedia or WordPress. There is no verified evidence presented here that Wikipedia itself was successfully hacked because of these vulnerabilities. The broader warning should not be interpreted as confirmation of a breach at any particular website. Whether an individual website is vulnerable depends on its PHP version, configuration, security controls and patch status. Website administrators must determine whether their systems are affected rather than assuming every PHP powered website faces the same level of risk.

Artificial Intelligence Helped Researchers Identify Vulnerabilities

Artificial intelligence has also become part of the discussion surrounding the security issue. Researchers have increasingly used AI tools to analyze source code, identify weaknesses and investigate possible attack methods. According to reporting about the disclosure, security researchers used AI assisted techniques while investigating the PHP vulnerabilities. The findings illustrate how these tools can help cybersecurity teams examine complex software and identify weaknesses that might otherwise go undetected.

However, AI assisted vulnerability discovery creates risks as well as opportunities. The same general capabilities that help defenders identify flaws could also help malicious actors search for weaknesses and develop attacks. Finding a vulnerability is only the first step. Researchers and software maintainers must verify the problem, develop a reliable fix and communicate the necessary steps to organizations that rely on the affected software. The incident reinforces the importance of responsible vulnerability disclosure, rapid security updates and cooperation between software developers and cybersecurity teams.

Concerns About Delays in Fixing Security Problems

The vulnerability disclosure has also raised questions about how security issues are managed in widely used open source software. Open source projects allow developers to inspect, modify and distribute code. This model can encourage collaboration and make software improvements accessible to a global community. However, open source availability does not guarantee that every security weakness will be discovered or addressed quickly. Some projects depend on relatively small teams to maintain software used by millions of people and businesses. When a serious vulnerability is discovered, developers must investigate the issue, create and test a patch, and coordinate its release. Even after a fix becomes available, protection depends on website owners, hosting companies and administrators installing the update. Systems that remain unpatched can continue to face risks after the vulnerability becomes publicly known.

Government Agencies Urge Organizations to Apply Security Updates

Cybersecurity authorities have emphasized the importance of addressing critical software vulnerabilities promptly. Organizations responsible for public services, commercial websites and internal networks must identify affected systems and follow official security guidance. A security advisory does not necessarily mean that an attack has already occurred. Authorities may recommend urgent action because a vulnerability creates a serious opportunity for exploitation, even before confirmed attacks are reported.

Organizations may also temporarily restrict access to vulnerable systems when they cannot apply a fix immediately. Such precautions can reduce exposure while administrators work to secure the affected software. Website operators should consult official PHP security announcements and relevant cybersecurity advisories for the precise versions affected, available patches and recommended mitigation steps.

What Could Happen if a Website Is Not Updated?

If an attacker successfully exploits a vulnerable server, the potential consequences can extend beyond the website’s public pages. Depending on the vulnerability and the server’s configuration, possible consequences include unauthorized access to files, exposure of sensitive information, changes to website content, disruptions to online services and attempts to compromise connected systems. A compromised server may also be used to host malicious files or support additional attacks. Organizations that store customer information or connect their websites to internal business systems may face additional risks if an attacker gains sufficient access. These are potential outcomes of successful exploitation, not proof that every vulnerable website has experienced an attack. Website owners should also recognize that installing a patch does not automatically establish that a previously exposed system is clean. Organizations that suspect a compromise may need to review system logs, investigate suspicious activity and follow incident response procedures.

What Website Owners Should Do

Website owners and administrators should begin by identifying whether their systems use PHP and determining which versions are installed. They should compare those versions against official security advisories and install the appropriate updates as soon as possible. Organizations should also review server configurations, confirm that patches were successfully applied and monitor systems for suspicious activity. Businesses that rely on third party hosting providers or managed website platforms should contact those providers to confirm whether the issue has been assessed and resolved. Updating website content or individual plugins may not address a vulnerability in the underlying PHP runtime. If an exposed system cannot be secured promptly, administrators should follow official guidance on restricting access or temporarily taking the system offline. Ordinary internet users generally do not need to install PHP patches on their personal computers because PHP typically runs on web servers. Users should nevertheless keep their devices and browsers updated, use multifactor authentication where available and remain cautious about suspicious links and unexpected requests for personal information.

Why This Matters for the Wider Internet

The PHP security issue highlights how much of the internet depends on shared software components. A weakness in a widely used programming language can create a significant challenge for organizations that operate otherwise unrelated websites. The warning also demonstrates why software maintenance and security funding matter. Open source software can support essential public and commercial services, but those services depend on developers having the resources to investigate vulnerabilities and produce reliable fixes.

Artificial intelligence may help security researchers discover problems more quickly, but effective protection requires action from software maintainers, hosting providers and website administrators. The most important distinction is that a widespread vulnerability does not mean the entire internet has been compromised. It means affected systems may face serious risks if they remain exposed and unpatched. For Wikipedia and other websites that depend on PHP, the priority is determining whether the installed software is affected, applying the appropriate security updates and verifying that systems remain protected.

Official Sources and Security Resources

1. The PHP Foundation
2. Official PHP Website
3. PHP Supported Versions and Security Information
4. U.S. Cybersecurity and Infrastructure Security Agency
5. National Vulnerability Database
6. WordPress Security

7. MediaWiki Security