Key points
- The Wikimedia Foundation took services like Toolforge offline to patch the vulnerability.
- Telecom giant Orange suspended access to PHP-based sites across dozens of countries.
- No confirmed fix exists yet, leaving many organizations in a holding pattern.
Major websites are currently offline or restricting operations because of a severe vulnerability found in PHP. This coding language powers a significant portion of the internet. Organizations are shutting down services to prevent exploitation while they work on patches. The situation has caused widespread disruption for users relying on these platforms.
In plain English
PHP is a programming language used to build dynamic websites. A major flaw in this language has been discovered. Because so many sites use PHP, the impact is broad. Organizations are taking sites offline to patch the vulnerability. Until patches are applied, these services remain unavailable to users.
View the original post on X
View the original post on X
The background
The Wikimedia Foundation announced it took supporting services offline to patch the issue. This includes tools like Toolforge and Cloud VPS. Wikipedia users may experience outages during this process. The Internet Archive was also offline on October 21, though the link to PHP was not definitively confirmed. Founder Brewster Kahle praised staff for limiting damage.
What changes now
Telecommunications company Orange has temporarily suspended access to several websites and apps using PHP. This precautionary measure affects dozens of countries in Europe, Africa, and the Middle East. Orange apologized for the inconvenience to its millions of customers. Each country is communicating which specific local sites are affected. Many other high-traffic sites are also impacted.
Who needs to act first
Teams should prioritize updating systems that face the internet directly. Check whether your servers run vulnerable PHP versions. Roll out fixes carefully by testing in a staging environment first. Back up all data before making changes. If no patch is available yet, consider taking non-essential services offline to reduce exposure. Monitor logs for unusual activity.
What to do and how to stay safe: PHP
- Identify all servers running PHP and check their version numbers.
- Monitor official vendor channels for patch announcements.
- Restrict access to non-essential web applications temporarily.
- Review server logs for signs of unauthorized access attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which major websites have gone offline due to the PHP vulnerability?
The Wikimedia Foundation took services like Toolforge offline, and Orange suspended access to several sites.
Is the Internet Archive outage definitely caused by the PHP flaw?
No, the Internet Archive was offline on October 21, but this was not definitively linked to the incident.
How is Orange handling the situation for its customers?
Orange temporarily suspended access to PHP-based sites in dozens of countries as a precautionary measure.
