Two critical security flaws in PHP, the code behind most of the web, pushed hundreds of websites offline on Wednesday, October 21. Gaming and esports sites are caught up in it too, with esports wiki Liquipedia among those down for users. PHP released a fix at about 13:45 UTC (7:15 PM IST), but every site still has to install it.
The bugs, nicknamed PHP2Shell, could let attackers run their own code on a website’s server without logging in. Security agencies in Europe, the UK, Australia and Japan told site owners to patch at once or go offline until they could.
If a gaming wiki, forum or fan site you use is down today, this is the most likely reason. Expect some sites to keep flickering for the next day or two
What happened with PHP
On Tuesday evening, PHP’s security team gave advance notice of two critical bugs and a fix scheduled for 14:00 UTC Wednesday. Details had already leaked, and Cloudflare said it was seeing attack attempts.
The EU’s cyber response team, CERT-EU, then told organisations that couldn’t patch quickly to consider pulling sites offline. Agencies in the UK, Australia, Japan, Germany and the Netherlands issued similar warnings, as The Record reported.
Many listened. The Dutch parliament, government portals in Finland and France and even the Dutch cyber security centre’s own site went dark as a precaution.
Why gaming and esports sites are so exposed
PHP runs about 69% of websites, according to W3Techs. In gaming, it sits under a lot of the community web.
| Type of site | Why it’s affected |
|---|---|
| Esports and game wikis | Most run on MediaWiki, which is written in PHP. Liquipedia is one |
| Forums and boards | Classic forum software is mostly PHP |
| News and fan sites | WordPress runs on PHP |
| Game server panels | Pterodactyl, popular for Minecraft and other servers, is built on PHP’s Laravel framework |
| Clan and tournament sign-up sites | Often small WordPress or custom PHP builds on shared hosting |
Big platforms like Steam, Battle.net or the PlayStation Network aren’t known to be affected. The risk is mostly the community layer around games: the wikis, forums and fan sites players rely on every day.
Gaming sites hit so far
The list is still growing, but a few are already clear.
- Liquipedia: The esports wiki was down for users on Wednesday. It hasn’t confirmed the cause, but its MediaWiki software runs on PHP.
- Wikipedia: Some parts went down, according to NBC News. Many game wikis use the same software.
- Forums: 4chan and Something Awful, both home to big gaming boards, went offline to wait for the patch.
- Japan: Some video game services went offline voluntarily, Japanese outlet ITmedia reported via NBC News.
If you’re following a tournament while wikis are down, use official league sites and organiser accounts on X and Discord. For BGMI, our BMSD 2026 winner report has the final standings.
Do gamers need to do anything?
Not much. PHP2Shell is a server bug, so simply visiting a site doesn’t put your PC, console or phone at risk.
The real danger is scams. Expect fake “mirror” links for downed wikis and messages telling you to download a “security patch”, so ignore both.
If a site you have an account on later says it was breached, change that password and turn on two-factor sign-in. Our guide to protecting your gaming account walks through it.
What gaming site owners should do now
If you run a clan site, forum, wiki or server panel, check your PHP version today. You’re covered on 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.
PHP 8.1 and older get no official fix. The project published patches for 7.4, 8.0 and 8.1 on GitHub for vendors to backport, but upgrading is the safer route.
On WordPress, core and plugin auto-updates won’t fix this. Security firm Wordfence told site owners to find out who manages PHP on their server, which on shared hosting is usually the host.
Self-hosting Pterodactyl or a similar panel? Update the server’s PHP, then restart PHP-FPM or your web server so the new version actually loads. Help Net Security has the technical breakdown of both bugs.
How long will sites stay down?
Sites that went offline only as a precaution usually return within hours of patching. Dutch officials warned that some could take several hours to come back.
Older sites stuck on unsupported PHP may take much longer, since they need a bigger upgrade first. Roughly half of PHP sites run older versions, according to experts quoted by The Record.
We’ll update this story as more gaming and esports sites confirm outages or come back online.
