Expect to see a significant number of websites serving error pages and going offline today, as nearly 70 percent of all web properties face an urgent requirement to update their core software. A pair of critical, newly disclosed vulnerabilities in PHP—the foundational programming language driving a massive share of the internet—allows an unauthorized attacker to seize full control over affected servers. Cybersecurity experts have confirmed that working exploits for these flaws already exist in the wild and are actively being leveraged against vulnerable systems across the globe.
The vulnerabilities reside directly within PHP, the script-processing engine that powers countless websites, applications, and content management systems, including major platforms like WordPress, Drupal, Magento, and Joomla. In response to the crisis, the PHP development team released an emergency security update earlier today. This patch addresses two critical bugs that can permit a remote attacker to execute arbitrary code of their choosing directly on an unpatched web server, paving the way for complete system compromise.
International reporting from Reuters highlights that government websites in Europe and various other regions went dark or were deliberately taken offline following the public disclosure of the PHP vulnerabilities. Meanwhile, infrastructure and security giant Cloudflare reported that it had already detected exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall (WAF) rules designed to intercept and block incoming malicious traffic seeking to leverage the bugs. According to technical assessments, these vulnerabilities are capable of triggering catastrophic outcomes, including denial-of-service conditions, remote code execution, and widespread data exposure.
OpenAI, which played a collaborative role alongside security researchers in investigating the vulnerabilities and coordinating outreach, released a statement emphasizing the unprecedented nature of the discovery. Given the sheer severity of these security flaws paired with PHP’s omnipresence across the global digital landscape, OpenAI characterized the incident as one of the most impactful security issues witnessed in recent memory.
Data from Censys, a digital infrastructure tracking firm, underscores the immense scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP infrastructure. Security researchers at Wiz further compounded these concerns by revealing that virtually every PHP version released over the past decade is impacted by at least one of these high-severity vulnerabilities.
The discovery team at Wiz, which was credited alongside other organizations for uncovering the flaws, published a comprehensive technical analysis stating that these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software development. The researchers noted that the underlying architectural flaws had quietly persisted within the codebase for decades. However, demonstrating their practical exploitability previously required an exceptionally complex chain of operational steps that stretched human researchers nearly to their limits. The integration of frontier artificial intelligence models significantly lowered that barrier, effectively transforming a long-standing theoretical weakness into a functional, highly dangerous exploit vector.
According to projections from Wiz, threat actors are expected to mass-exploit the PHP vulnerabilities to install web-based backdoors, commonly referred to as "web shells." These malicious panels provide attackers with persistent, remote administrative control over compromised web servers. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, technology firm Calif, and OpenAI to accurately measure the scope of the problem, verify effective patches, and orchestrate a coordinated disclosure timeline.
The zero-day vulnerabilities are officially being tracked by the Common Vulnerabilities and Exposures database under the identifiers CVE-2026-109618 and CVE-2026-109619. The flaws affect all web servers operating on PHP versions 5.4 and later. The PHP group has issued official fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, urging administrators to apply the updates immediately.
Wiz analysts warn that because PHP is so deeply integrated and foundational to a vast array of web applications, organizations will likely struggle with remediation and patching for an extended period. Industry experts have drawn direct comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that sent shockwaves through the cybersecurity community in 2021—a similarly pervasive and severe software flaw found within the popular Java logging framework Log4j.
A vulnerability rooted in core PHP extends its reach far beyond any single application or isolated web service, the Wiz researchers explained in their analysis. PHP operates ubiquitously across major cloud environments, specialized hosting providers, global content-delivery networks, and millions of independently administered servers. Mitigating exposure before the technical details became public required a monumental, synchronized effort across the entire digital ecosystem.
The SANS Internet Storm Center is closely monitoring the situation as major software distributors and operating system vendors rapidly ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already rolled out updated PHP packages for its user base. Additionally, security firm Calif—another key organization credited with discovering the vulnerabilities—has published a detailed technical breakdown chronicling the timeline of the bug discovery in a distinct format.
As this remains a fast-moving operational story, network administrators and security professionals are advised to monitor official advisories and apply the newly released PHP patches without delay to safeguard their infrastructure from active exploitation.
