Expect to see quite a few websites serving error pages today: nearly 70 percent of all websites on the internet need to update their core software immediately to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that working exploits for the flaws already exist in the wild, and that these critical bugs are actively being exploited by malicious actors across the globe.
The vulnerabilities at the center of this unfolding crisis are present in PHP, the foundational programming language that powers an enormous share of the modern web. This includes sites running on major web publishing systems, content management platforms, and e-commerce frameworks such as Drupal, Magento, Joomla, and WordPress. In response to the immediate danger, the PHP development team released an emergency security update earlier today to patch two critical bugs that can allow an authenticated or unauthenticated attacker, depending on the vector, to execute arbitrary code of their choosing on any vulnerable web server.
International news reports indicate that government websites in Europe and various other regions went offline earlier today after the PHP vulnerabilities were publicly disclosed. Major infrastructure and security providers have also mobilized. Cloudflare announced that it has already detected active exploitation of the flaws in the wild. To combat this, the company implemented specialized web application firewall rules at 3:02 am UTC to protect customer websites from incoming attack traffic seeking to exploit the bugs. According to technical advisories, these vulnerabilities could cause severe operational disruptions, including denial of service conditions, remote code execution, and dangerous data exposure.
OpenAI, which played a direct role in the vulnerability research and coordinated outreach efforts preceding the disclosure, stated that given the sheer severity of these flaws and PHP’s remarkably widespread use across the global digital landscape, they consider this to be one of the most impactful security issues in recent memory.
Internet scanning and telemetry firm Censys reported that a recent comprehensive scan identified approximately 2.58 million internet-facing hosts and an astonishing 54.9 million individual web properties running PHP. Meanwhile, security researchers at Wiz noted that virtually every single PHP version released over the past decade is affected by at least one of these critical vulnerabilities.
These findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software development, according to a detailed blog post published today by a team of researchers at Wiz, who were one of several key organizations credited with discovering the vulnerabilities. The underlying flaws had actually been present within the codebase for decades, but demonstrating their exploitability required an exceptionally complex chain of steps that pushed the absolute boundaries of what human researchers could practically achieve on their own. However, frontier artificial intelligence models substantially reduced that formidable technical barrier, effectively turning a longstanding, theoretical flaw into a working, weaponized exploit.
The Wiz research team warned that it is highly likely these PHP vulnerabilities will be subjected to mass exploitation by cybercriminal groups and state-sponsored actors alike. The primary objective will likely be the installation of web-based backdoors, commonly referred to as web shells, which provide attackers with a discrete web-based administrative panel allowing them to remotely control infected web servers at will. Prior to the public disclosure of the PHP bugs, Wiz worked closely with the PHP security team, technology firm Calif, and OpenAI to accurately measure the true scale of the problem and coordinate rigorous patch verification and responsible disclosure.
The critical PHP zero-day vulnerabilities are being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or any subsequent version. The core development team has successfully resolved the bugs in newly released versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and administrators are urged to apply these patches immediately.
According to Wiz, PHP is so deeply embedded into the architecture of countless web applications, enterprise frameworks, and hosting environments that organizations will likely struggle to patch these vulnerabilities for a significant period of time. Industry analysts have naturally drawn comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that emerged in late 2021—a widespread and severe security flaw found in Log4j, a widely utilized Java logging framework that kept corporate and government security teams scrambling for months.
A vulnerability in core PHP reaches far beyond a single application or isolated web service, the Wiz researchers explained in their advisory. PHP runs across multi-tenant clouds, specialized hosting providers, global content-delivery networks, and millions of independently managed servers worldwide. Successfully reducing exposure before the highly technical details became public required an unprecedented level of coordinated work across that entire sprawling ecosystem.
In the wake of the disclosures, the SANS Internet Storm Center has been closely monitoring the situation as major software platforms, Linux distributions, and hosting ecosystems ship emergency updates to deal with the PHP flaws. For instance, Ubuntu quickly released updated PHP packages to safeguard its user base. For web administrators and developers looking for a technical deep-dive on these vulnerabilities, technology firm Calif—another key entity credited with finding the original bugs—has published an extensive breakdown detailing the timeline and mechanics of the discovery. As the digital ecosystem works frantically to patch systems before automated scanners fully weaponize the exploit chain, web administrators worldwide face a tense race against time.
