Internet users and system administrators worldwide should prepare for widespread service disruptions today following the urgent disclosure of a pair of critical vulnerabilities in PHP, the foundational programming language that drives a massive portion of the modern web. Security researchers, infrastructure providers, and emergency response teams have confirmed that nearly 70 percent of all websites running core PHP software require immediate updates to mitigate flaws that grant attackers full, unfettered control over affected servers. Working exploits for the bugs are already circulating actively in the wild, forcing a scramble across the global technology ecosystem.
The vulnerabilities reside deep within the architecture of PHP, a scripting language leveraged by millions of web publishing systems, content management platforms, and e-commerce applications, including WordPress, Joomla, Magento, and Drupal. In response to the crisis, the PHP development team released an emergency security update earlier today. The patches are designed to neutralize two critical bugs capable of allowing malicious actors to execute arbitrary code of their choosing on any vulnerable web server connected to the internet.
The cascading impact of the disclosure was felt almost immediately across international infrastructure. Reuters reported that government websites in Europe and various other regions were forced offline temporarily as system administrators panicked or actively disconnected systems to prevent compromise while emergency patches were deployed. Meanwhile, cloud security and content delivery giant Cloudflare noted that it had already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to intercept and block malicious traffic seeking to exploit the vulnerabilities, which present severe risks including denial-of-service conditions, remote code execution, and unauthorized data exposure.
Artificial intelligence pioneer OpenAI, which played a pivotal role alongside other industry leaders in vulnerability research, testing, and coordinated disclosure outreach, issued a stark assessment of the situation. Given the extraordinary severity of these flaws paired with PHP’s near-ubiquitous presence across the digital landscape, OpenAI characterized the incident as one of the most impactful security issues witnessed in recent memory.
Data from Censys, a digital infrastructure and threat-tracking organization, underscores the massive scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and an astonishing 54.9 million individual web properties running PHP. Security analysts at Wiz further amplified the alarm, pointing out that every single major version of PHP released over the past decade is affected by at least one of these two vulnerabilities.
In a comprehensive technical advisory published today, researchers at Wiz—who shared credit as part of the coalition that discovered the bugs—stated that these findings rank securely among the most severe vulnerabilities ever uncovered in PHP history, and arguably in the broader history of software engineering as a whole. According to the Wiz research team, the underlying structural flaws had actually remained quietly embedded within the language for decades. However, demonstrating their exploitability previously required an exceptionally complex, multi-layered chain of steps that sat right at the absolute edge of what human researchers could practically achieve.
The dynamic shifted dramatically with the advent of frontier AI models. Researchers noted that advanced artificial intelligence substantially lowered the traditional barrier to entry, effectively transforming a longstanding, theoretical flaw into a dangerous, functional exploit. Wiz researchers warned that the PHP vulnerabilities are highly likely to experience widespread, automated mass-exploitation. Attackers are expected to leverage the bugs to install persistent, web-based backdoors or web shells, which provide malicious actors with a convenient graphical panel to maintain remote command and control over compromised websites indefinitely. Prior to the public disclosure, Wiz collaborated closely with the core PHP development team, security firm Calif, and OpenAI to measure the true breadth of the problem and coordinate patch verification and responsible disclosure timelines.
The zero-day vulnerabilities are officially tracked under identifiers CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP versions 5.4 and later. The core development team has addressed the issues directly in newly released versions, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply intertwined with the underlying architecture of countless web applications, content management systems, and hosting infrastructures, industry experts warn that organizations will likely struggle with patch management for an extended period. Wiz explicitly compared the current PHP crisis to the infamous Log4Shell weakness that sent shockwaves through the cybersecurity industry in 2021, which targeted the popular Log4j Java logging framework.
As the Wiz research team emphasized in their advisory, a core vulnerability in PHP reaches far beyond the boundaries of any single application. PHP operates invisibly across cloud environments, hosting providers, content delivery networks, and millions of independently managed servers worldwide. Successfully mitigating exposure before technical details leaked into the public domain required unprecedented, synchronized coordination across the entire global technology ecosystem.
Meanwhile, monitoring bodies such as the SANS Internet Storm Center are maintaining continuous surveillance over major software platforms and Linux distributions as they rush to ship updated packages. Ubuntu, for instance, has already rolled out updated PHP packages to help system administrators secure their environments. For organizations seeking a technical deep dive into the vulnerabilities, technology company Calif—another key player credited with discovering the bugs—published a detailed timeline of the discovery process rendered in a distinctive comic-book style.
As system administrators around the world scramble to update their systems, error pages are expected to remain common sights on the web throughout the day. Security analysts advise all webmasters and infrastructure managers running affected PHP versions to apply the emergency patches immediately to prevent unauthorized server takeover.
