Expect to see quite a few websites serving error pages today as internet infrastructure grapples with a massive security event. Nearly 70 percent of websites across the globe are facing an urgent need to update their core software to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts confirm that working exploits for the flaws already exist in the wild, and malicious actors are actively exploiting these critical bugs to target vulnerable web applications.
The vulnerabilities at the center of the crisis reside within PHP, the ubiquitous programming language that powers a staggering share of the internet. PHP forms the foundational backbone for websites running on a vast array of web publishing systems, content management frameworks, and e-commerce platforms, including Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to patch two critical bugs capable of allowing an attacker to execute arbitrary code of their choosing on any vulnerable web server.
Global fallout from the disclosure was immediate. Reuters reports that government websites in Europe and various other regions went offline today as administrators scrambled to respond to the PHP vulnerabilities. Meanwhile, infrastructure and security giant Cloudflare reported that it had already detected active exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented emergency web application firewall rules designed to shield websites from attack traffic attempting to exploit the bugs. These vulnerabilities carry the potential to trigger denial of service conditions, remote code execution, and dangerous data exposure.
OpenAI, which played a direct role in the vulnerability research and coordinated outreach efforts preceding the public disclosure, emphasized the immense gravity of the situation. Given the severe nature of these flaws and the exceptionally widespread use of PHP across the global digital ecosystem, OpenAI stated that it considers this issue to be one of the most impactful security events in recent memory.
Data compiled by Censys, a firm that tracks internet-facing technology and hosts, underscores the massive scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties currently running PHP. Security researchers at Wiz added further context, noting that every single major version of PHP released over the last decade is affected by at least one of these vulnerabilities.
The discovery itself represents a technological milestone in the ongoing arms race between cybersecurity defenders and advanced computing capabilities. Researchers at Wiz, who were credited alongside other organizations for discovering the vulnerabilities, published a detailed blog post outlining the unprecedented nature of the find. According to Wiz, these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software development.
The underlying flaws had actually been present within the language for decades, remaining dormant because demonstrating their exploitability required an exceptionally complex chain of steps. That complexity sat right at the absolute edge of what human researchers could practically achieve on their own. However, frontier AI models substantially reduced that formidable barrier, effectively turning a longstanding theoretical flaw into a working, highly dangerous exploit chain.
The Wiz researchers warn that it is highly likely these PHP vulnerabilities will face widespread, mass exploitation by malicious actors seeking to install web-based backdoors, commonly referred to as web shells. These web-based panels give attackers remote control over infected sites, enabling long-term persistence and unauthorized access. Before making the bugs public, Wiz worked closely with the PHP team, Calif, and OpenAI to measure the true size of the problem, coordinate patch verification, and carefully plan a responsible disclosure timeline.
The PHP zero-day vulnerabilities are officially tracked by their respective CVE numbers: CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or later. To neutralize the threat, administrators must upgrade to the newly released patched versions, which include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply embedded into the architecture of modern web applications, Wiz cautions that organizations will likely struggle to patch these vulnerabilities for a considerable amount of time. Industry experts have drawn direct comparisons between this PHP vulnerability pair and the notorious Log4Shell weakness that emerged in 2021. Log4Shell proved to be a remarkably widespread and severe security flaw affecting Log4j, a popular Java logging framework, leaving companies scrambling for years to find and remediate vulnerable instances.
As the Wiz researchers pointed out, a vulnerability residing in core PHP reaches far beyond any single application. PHP operates quietly across multi-tenant clouds, dedicated hosting providers, major content-delivery networks, and millions of independently managed servers worldwide. Reducing exposure before the technical details became public required an unprecedented level of coordinated work across that entire sprawling ecosystem.
In the wake of the disclosures, the SANS Internet Storm Center began closely monitoring major software platforms and Linux distributions as they rushed to ship updated packages to deal with the PHP flaws. For instance, Ubuntu promptly released updated PHP packages to assist system administrators. For teams seeking a technical deep-dive into the vulnerabilities alongside a timeline of how the bugs were discovered, technology company Calif—another organization credited with finding the flaws—published a detailed resource presented in a unique comic book style.
As this remains a fast-moving story with widespread implications for global cybersecurity, internet service providers, website administrators, and hosting platforms continue to monitor infrastructure logs and apply emergency patches. Censys has also established a dedicated tracking portal at php2shell.censys.com to monitor the evolving landscape of exposed hosts as organizations race to secure their systems against ongoing exploitation attempts.
Comments (0)