Wikimedia, Archive.org and 4chan pause services for PHP2Shell fixes

Several Wikimedia services, Archive.org and 4chan were temporarily taken offline for security updates following the discovery of PHP2Shell vulnerabilities, 404 Media reported on October 22, 2026. The interruptions were precautions to protect potentially vulnerable services, rather than reported consequences of successful attacks.

The shutdowns followed the discovery of flaws in PHP, a programming language used to run websites. According to 404 Media, researchers from Wiz, Calif and OpenAI found the vulnerabilities using AI tools. The US National Security Agency and other governments subsequently told operators to install security fixes immediately and take offline services they could not patch.

Millions of attempts are not millions of break-ins

Cloudflare chief executive Matthew Prince reported a sharp rise in attempts to exploit PHP2Shell across the company’s network. His figures describe attempts to use the flaws, not successful compromises.

Cybersecurity company Trail of Bits had developed a working exploit, its chief executive Dan Guido said. An exploit is a method or piece of code that uses a software flaw to attack a system. That company-reported research result is distinct from evidence of widespread attacks succeeding.

404 Media said most impacts at that point involved precautionary updates or taking potentially insecure websites offline, and that it had not seen immediate, widespread exploitation. Many hastily published exploits generated with language models did not work, the outlet reported. The scale of successful exploitation remained uncertain.

Early fixes draw criticism

The disclosure process also drew criticism. Security company Chainguard published fixes several hours before the scheduled public disclosure, 404 Media reported. Critics, including the PHP Foundation, said the fixes could have helped attackers work out how to exploit the flaws before website operators could protect their systems.

Chainguard chief executive Dan Lorenc said his company independently found the same bugs by asking an AI model to find serious vulnerabilities in PHP. Separately, OpenAI argued that its disclosure process gave governments and critical infrastructure time to prepare. 404 Media raised questions about why exploit attempts had begun before public disclosure.

Operators face immediate patching decisions

The reported government instructions set out the immediate next step for operators: patch vulnerable websites and services, or take them offline if patching is not possible.