Web administrators across the globe are facing an urgent scramble today as nearly 70 percent of all websites require immediate core software updates to mitigate a pair of devastating security vulnerabilities. These flaws, which have been present in the PHP programming language for decades, allow attackers to seize full control over affected servers, leading to a widespread alert that has already seen government websites taken offline and prompted a massive, industry-wide response.
The vulnerabilities are considered so severe that researchers and security firms are comparing the situation to the infamous "Log4Shell" incident of 2021. Experts have confirmed that functional exploits for the bugs are already being utilized in the wild, creating a race against time for server operators to patch their systems before their data or infrastructure is compromised.
The Scope of the Crisis
PHP serves as the backbone of the modern internet, powering a staggering array of content management systems and web publishing platforms, including Drupal, Magento, Joomla, and WordPress. Because these platforms are the building blocks of millions of websites, the discovery of vulnerabilities in the core language itself creates a systemic risk that is difficult to overstate.
According to data from Censys, a firm that tracks internet-facing technologies, a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties currently running PHP. Because PHP is so deeply embedded into the infrastructure of cloud providers, content delivery networks (CDNs), and independently managed servers, the effort required to identify and patch every vulnerable instance is monumental.
The security researchers at Wiz, who were among the organizations credited with the discovery, noted that every single version of PHP released in the last decade is affected by at least one of these two vulnerabilities. "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," the research team stated in a technical advisory.
The Role of Frontier AI
What makes these specific vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619—particularly concerning is the method of their discovery. While the underlying flaws have existed in the PHP source code for decades, they remained hidden because demonstrating their exploitability required an exceptionally complex, multi-step chain of actions.
According to Wiz, this chain was at the very edge of what human researchers could practically achieve on their own. However, the application of "frontier" artificial intelligence models substantially reduced that barrier. By utilizing these advanced computational tools, researchers were able to turn a long-standing, theoretical architectural flaw into a weaponized exploit.
OpenAI, which collaborated on the vulnerability research and subsequent outreach, emphasized the gravity of the situation. "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory," the company noted in a statement. This incident highlights a new, sobering reality in cybersecurity: the same AI tools capable of driving innovation are also capable of accelerating the discovery of critical vulnerabilities that have remained dormant for years.
Immediate Impact and Industry Response
The impact of the vulnerability was felt almost immediately after disclosure. Reuters reported that several government websites in Europe and other regions were taken offline today as a proactive measure to protect against potential unauthorized access while patches were being applied.
Cloudflare, the web security and performance giant, reported that it had detected active exploitation of the flaws well before the public disclosure. By 3:02 am (UTC), the company had already implemented specific web application firewall (WAF) rules designed to filter out attack traffic. These attacks are primarily aimed at achieving remote code execution (RCE), which allows a malicious actor to run arbitrary commands on the server, potentially leading to total data exposure or the deployment of web-based backdoors.
These backdoors, often referred to as "web shells," are of particular concern to security professionals. A web shell provides an attacker with a user-friendly, browser-based control panel that grants them persistent remote access to the infected server. Once a web shell is installed, an attacker can maintain control even if the original vulnerability is patched, unless the administrator performs a thorough forensic cleanup of the server.
Patching and Mitigation
The PHP project team responded to the discovery by releasing emergency security updates. The vulnerabilities are effectively mitigated in the latest versions of the language: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These updates cover all supported versions of the language and are critical for any organization currently running PHP 5.4 or later.
The SANS Internet Storm Center is actively monitoring the situation, tracking how major software platforms and distributions are handling the roll-out of these patches. For instance, Ubuntu has already moved to release updated PHP packages, and other Linux distributions and hosting environments are expected to follow suit immediately.
The process of patching, however, is likely to be a prolonged struggle. Because PHP is often buried deep within custom web applications and legacy systems, simply updating the server-side language may not be enough for some users. Organizations must also verify that their specific applications—many of which rely on complex dependencies—are compatible with the newer, secure versions of PHP.
Wiz researchers compared the current challenge to the 2021 Log4Shell crisis, noting that the ubiquitous nature of the language means the risk extends far beyond any single application. "A vulnerability in core PHP reaches far beyond a single application," the researchers explained. "PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."
Looking Ahead
In the wake of this discovery, organizations are being urged to treat these patches with the highest priority. The existence of "in-the-wild" exploitation means that attackers are not waiting for administrators to catch up. For those looking to understand the technical nuances of how these vulnerabilities function, the technology firm Calif has provided a detailed, visual breakdown of the discovery process, offering a "comic book style" timeline that illustrates how the flaws were uncovered and why they were so difficult to find for so long.
For the average web administrator, the advice from security professionals is clear: monitor server logs for suspicious traffic, apply the latest PHP updates as soon as possible, and ensure that any internet-facing systems are shielded by robust firewall configurations. As the situation evolves, infrastructure providers are continuing to update their defensive posture to prevent the mass-exploitation of these critical bugs. The event serves as a stark reminder of the fragile nature of the internet’s software supply chain and the ongoing necessity for coordinated, global responses to emerging digital threats.
