Webmasters and system administrators worldwide are facing a scramble to patch their infrastructure today, as approximately 70 percent of websites need to update their core software to address a dangerous pair of vulnerabilities. These critical bugs allow an unauthorized attacker to seize full control over affected servers, and security experts confirm that working exploits are already circulating and being actively leveraged in the wild.
The vulnerabilities reside deep within PHP, the ubiquitous server-side programming language that forms the backbone of a massive proportion of the internet’s web publishing systems, content management platforms, and e-commerce sites, including WordPress, Drupal, Joomla, and Magento. In response to the unfolding crisis, the PHP development team released an emergency security update earlier today designed to patch two critical flaws capable of allowing malicious actors to execute arbitrary code of their choosing on any vulnerable server.
The global impact of the disclosure was felt immediately. According to reports from Reuters, various government websites across Europe and other regions went offline as public sector IT teams raced to respond to the PHP vulnerability warnings. Meanwhile, cloud infrastructure and security provider Cloudflare reported that it had already detected exploitation attempts targeting the flaw. At 3:02 am UTC, Cloudflare implemented dedicated web application firewall rules designed to shield protected websites from incoming attack traffic seeking to exploit the bugs, which security researchers note could trigger denial-of-service conditions, remote code execution, and sensitive data exposure.
OpenAI, which played a collaborative role alongside security researchers in vulnerability identification and coordinated disclosure efforts, emphasized the unprecedented nature of the discovery. Given the sheer severity of these flaws and the monumental scale of PHP’s deployment across the global web, OpenAI stated that it considers this issue to be one of the most impactful security events in recent memory.
Internet scanning and telemetry firm Censys reported that a recent scan identified approximately 2.58 million internet-facing hosts and an astonishing 54.9 million individual web properties running PHP. Security researchers at Wiz added further context to the widespread risk, noting that virtually every major version of PHP released over the last decade is affected by at least one of these critical vulnerabilities.
In a comprehensive technical blog post published today, a team of researchers at Wiz—who were among the multiple organizations credited with discovering the vulnerabilities—described the findings as ranking among the most severe flaws ever uncovered in PHP, and arguably in software history. The Wiz team explained that the underlying vulnerabilities had actually been present within the language’s codebase for decades, but demonstrating their practical exploitability previously required navigating an exceptionally complex chain of steps right at the boundary of what human researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that barrier, effectively transforming a longstanding, theoretical software flaw into a fully functional exploit chain.
The Wiz researchers warned that the PHP vulnerabilities are likely to face widespread, automated mass exploitation aimed at installing web-based backdoors or "web shells." These malicious scripts provide attackers with a discrete web-based administrative panel that grants remote, persistent control over compromised sites. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem, verify effective patches, and orchestrate a coordinated disclosure timeline.
The zero-day vulnerabilities in PHP are currently being tracked under official Common Vulnerabilities and Exposures identifiers as CVE-2026-109618 and CVE-2026-109619. These flaws affect all web servers operating on PHP versions 5.4 or later. Official patches have been rolled out and are included in the newly released versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply intertwined with the architecture of countless modern web applications, Wiz cautioned that organizations will likely struggle with remediation and patching for an extended period. Security analysts have drawn direct comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that emerged in late 2021—a deeply embedded, severe-as-it-gets security flaw impacting Log4j, a widely utilized Java logging framework.
A vulnerability residing in core PHP reaches far beyond any single application or isolated content management system, the Wiz researchers explained. PHP runs across multi-cloud environments, enterprise hosting providers, content-delivery networks, and tens of millions of independently managed servers. Mitigating exposure and issuing warnings before technical details became publicly available required intricate, synchronized cooperation across the entire web ecosystem.
The SANS Internet Storm Center is closely monitoring the situation as major software distributions and platform maintainers ship rapid updates to address the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For those seeking a detailed technical deep-dive into the vulnerabilities and a chronicle of the discovery timeline presented in a comic book style, technology firm Calif—another organization credited with helping uncover the bugs—published an explanatory breakdown online.
As this remains a fast-moving security event, further updates, telemetry figures, and advisory notices from software vendors are expected to emerge throughout the day.
