Expect to see quite a few websites serving error pages today as administrators around the globe scramble to address a severe security crisis. Nearly 70 percent of websites running on the affected technology need to update their core software immediately to fix a pair of dangerous vulnerabilities that allow an attacker to seize full control over vulnerable servers. Security experts have confirmed that working exploits for these flaws already exist, and multiple telemetry sources indicate that these critical bugs are actively being exploited in the wild.
The flaws at issue are deeply embedded in PHP, the ubiquitous programming language that powers an enormous share of the modern internet. This includes websites running on a vast array of popular web publishing systems, content management frameworks, and e-commerce platforms, such as Drupal, Magento, Joomla, and WordPress. Earlier today, the PHP development team released an emergency security update designed to patch two critical bugs that can allow an unauthenticated attacker to execute arbitrary code of their choosing on any vulnerable web server.
The immediate fallout of the disclosure has already disrupted operations globally. Reuters reports that various government websites in Europe and across other regions went offline today as administrators preemptively pulled systems offline or grappled with fallout after the PHP vulnerabilities were publicly disclosed. Meanwhile, major internet infrastructure and security firms have mobilized to blunt the impact. Cloudflare reported that it has already detected live exploitation attempts targeting the flaws. At 3:02 am UTC, the company implemented specialized web application firewall rules designed to protect client websites from incoming attack traffic seeking to exploit the bugs. According to cloud and security providers, successful exploitation could lead to a severe denial of service condition, remote code execution, and unauthorized data exposure.
The severity of the situation has drawn warnings from major artificial intelligence and security research organizations. OpenAI, which was directly involved in the vulnerability research and coordinated outreach efforts preceding the public disclosure, stated that given the sheer severity of these flaws and PHP’s massive, foundational footprint across the global web, they consider this to be one of the most impactful security issues in recent memory.
Censys, a prominent visibility and security company that tracks technology architectures used by internet hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. The exposure surface is extraordinarily broad, crossing every major cloud provider, hosting platform, and enterprise infrastructure network. Security experts at Wiz added that virtually every PHP version released over the last decade is affected by at least one of these high-severity vulnerabilities.
In a detailed blog post published today, a team of researchers at Wiz—who were among several organizations credited with discovering the vulnerabilities—noted that these findings rank among the most severe security flaws ever discovered in PHP, and arguably in software history. The researchers pointed out that the underlying structural flaws had actually been present within the language for decades. However, demonstrating their practical exploitability previously required an exceptionally complex chain of steps, sitting right at the absolute edge of what human security researchers could practically achieve. According to Wiz, frontier AI models substantially reduced that formidable barrier, effectively turning a longstanding, theoretical flaw into a working, devastating exploit.
The Wiz researchers warn that it is highly likely these PHP vulnerabilities will face widespread mass-exploitation campaigns aimed at installing web-based backdoors or web shells. These malicious interfaces provide attackers with a discrete web-based control panel that allows them to maintain persistent, remote access to infected websites and underlying server infrastructure. Prior to the public disclosure of the bugs, Wiz worked closely with the PHP security team, Calif, and OpenAI to measure the true scale of the problem, coordinate patch verification, and ensure a structured disclosure process.
The zero-day vulnerabilities in PHP are currently being tracked by their official CVE identifiers, CVE-2026-109618 and CVE-2026-109619. They affect all web servers operating on PHP versions 5.4 or later. Official patches resolving the issues have been bundled into the newly released versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Upgrading to these patched versions or applying vendor-supplied backports is considered essential for maintaining server integrity.
Because PHP is so deeply embedded in the underlying architecture of countless web applications, frameworks, and enterprise environments, Wiz warns that organizations are likely to struggle with patching these vulnerabilities for a considerable period of time. Security analysts have drawn direct comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that emerged in 2021—a similarly widespread, maximum-severity security flaw found in Log4j, a popular Java logging framework.
As the Wiz researchers emphasized, a vulnerability in core PHP reaches far beyond any single standalone application. PHP operates seamlessly across multi-cloud environments, managed hosting providers, massive content-delivery networks, and millions of independently managed enterprise and small-business servers. Successfully mitigating the risk and reducing exposure before technical details leaked into the wild required unprecedented, coordinated work across that entire global technology ecosystem.
Meanwhile, monitoring bodies like the SANS Internet Storm Center are closely watching the situation as major Linux distributions, operating system vendors, and software platforms ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For organizations looking for a technical deep-dive into the mechanics of these vulnerabilities, as well as a timeline of their discovery presented in a unique format, technology company Calif has published a comprehensive breakdown. Censys has also established a dedicated tracking portal to monitor the global distribution of vulnerable hosts as the situation continues to evolve.
Comments (0)