GOG taken offline for maintenance in wake of PHP security emergency
A critical security crisis unfolded across the internet as multiple high-severity vulnerabilities in PHP, the widespread server-side scripting language powering an estimated 25% of all websites, were discovered and partially leaked ahead of official disclosure.
The PHP security team announced fixes for two critical vulnerabilities, each rated 9.2 out of 10 on the CVE severity scale, scheduled for release at 2pm UTC (10am Eastern Time). However, video demonstrations of a tool called PHP2Shell allegedly showing remote code execution capabilities via these vulnerabilities circulated before the official fix was available, prompting security teams worldwide to take immediate action.
The impact was immediate and widespread. GOG and its launcher GOG Galaxy went offline for maintenance at 8am Pacific Time, joining numerous other major websites in preemptive shutdowns. The government of Finland took down its websites as a precaution, and sites including Wikipedia, Slack, Spotify, and WordPress-powered platforms across the internet braced for emergency patching.
Cybersecurity researchers from Sansec warned that administrators should expect a surge of attacks following the patch release. The discovery poses a significant threat across the entire web ecosystem, as PHP underlies countless critical services and platforms. WordPress alone, built on PHP, powers approximately one-quarter of the world’s websites.
The vulnerability represents a race against time for web administrators: apply patches to defend against imminent attacks while the fix is being deployed globally. The combination of the high severity rating, advance knowledge of the exploits, and the ubiquity of PHP created what has been characterized as an internet-wide crisis requiring coordinated emergency response efforts.