For a brief while on Wednesday morning, it seemed like most of the Internet died suddenly. This was because of two major vulnerabilities recently uncovered within PHP, which approximately 70% of websites use.

To rectify this, the PHP project released security updates for site hosts to add. Since the sites had to go down for the installation to proceed, several sites and accompanying services went offline from government websites in Europe, 4chan and DeviantArt, the Wikimedia Foundation and Internet Archive, and even the servers of games like Umamusume. It’s such a massive concern that even those like Japanese prime minister Sanae Takaichi had to chime in.

Fortunately, 131 Off-Road never had such an issue and stayed online all day. We arehosted on WordPress.com, whose PHP is protected by Automattic. Despite the ongoing turmoil at the company with layoffs and even an attempted coup, the service remains fully active and able to keep this site from being targeted by nefarious actors. You might rightly ask who would want to go after an off-road racing site, but given we’ve mocked conspiracy theories and covered the Russian invasion of Ukraine in a less-than-positive light for the latter, we’re not taking any chances.

“If your site is hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, or Tumblr, your site is already protected,” reads a blog post from Automattic. “Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible. There is nothing you need to do.”

So what exactly is going on? We’re not going to claim we are cybersecurity experts, IT gurus, or web designers (though our editor did take a semester of Web Design in high school), but in layman’s terms, PHP is a programming language chiefly used in web development. Since it’s fairly easy to use, much of the Internet relies on it.

The vulnerabilities recently discovered—CVE-2026-109618 and CVE-2026-109619—are collectively called “PHP2Shell”. If the PHP runs out of memory while processing a request from the user, said process can be interrupted and even corrupted if a bad actor tries to hack into a website that runs on PHP. If the attacker can control PHP, they can manipulate it into running whatever command they want.

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released to “fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.”

That one xkcd comic about all modern digital infrastructure being supported by a tiny building block is sure relevant, isn’t it?

Featured image credit: Florent Gooden / DPPI / ASO