A massive wave of digital maintenance is rippling across the internet today as web administrators scramble to secure millions of servers against a pair of critical vulnerabilities in PHP, the ubiquitous programming language that serves as the backbone of modern web infrastructure. The discovery of these flaws, which allow attackers to gain full, unauthorized control over affected servers, has triggered an emergency response from software maintainers, government agencies, and security researchers worldwide. With experts confirming that functional exploits for the vulnerabilities are already being utilized in the wild, the race is on to patch systems before malicious actors can capitalize on the widespread exposure.
The vulnerabilities are present in the core of PHP, a scripting language that powers a vast majority of the world’s web publishing systems. From content management giants like WordPress, Drupal, and Joomla to e-commerce platforms like Magento, the reliance on PHP is so absolute that nearly 70 percent of all websites are currently estimated to be at risk. Earlier today, the PHP development team issued an emergency security update to address these two critical bugs. The flaws, designated CVE-2026-109618 and CVE-2026-109619, represent a nightmare scenario for system administrators, as they allow for remote code execution, enabling an attacker to run arbitrary commands on a target server with the same permissions as the web server itself.
The fallout from the disclosure was immediate. Reports from Reuters indicate that several government websites across Europe and other regions were forced offline today as a precautionary measure while technical teams worked to apply the emergency patches. Cloudflare, one of the world’s largest web infrastructure and security companies, confirmed it had already detected active exploitation of the flaws. In response to the threat, the company moved to implement defensive web application firewall (WAF) rules as early as 3:02 am UTC to shield its customers from malicious traffic. According to Cloudflare, the attack vectors targeting these vulnerabilities are designed to facilitate denial-of-service conditions, unauthorized data exposure, and complete system compromise through remote code execution.
The severity of the situation has drawn warnings from across the technology sector. OpenAI, which provided technical assistance during the vulnerability research and outreach process, noted the unprecedented nature of the discovery. In an official statement, the company characterized the situation as one of the most impactful security events in recent memory, citing both the inherent danger of the flaws and the sheer ubiquity of PHP in the global digital ecosystem.
The scale of the threat is immense. Censys, a firm specializing in monitoring internet-facing technology, conducted a scan of the digital landscape and identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties currently running PHP. This sprawling footprint makes the task of remediation a monumental logistical challenge. Security analysts at Wiz—who were among the organizations credited with identifying the flaws—have stated that every version of PHP released in the last decade is affected by at least one of these two vulnerabilities.
The discovery process itself represents a significant milestone in cybersecurity. According to a detailed blog post published by the Wiz research team, the underlying flaws have remained dormant in the PHP codebase for decades. Historically, these bugs were considered unreachable or too complex to exploit. However, the researchers revealed that the barrier to entry was significantly lowered by the application of frontier AI models. These models enabled the researchers to navigate an exceptionally complex chain of logic that was previously considered at the edge of what human researchers could practically achieve. By automating the identification of the exploit path, the AI essentially transformed a theoretical, long-standing architectural flaw into a weaponizable exploit.
Wiz researchers have warned that the industry should expect to see mass exploitation efforts aimed at installing persistent, web-based backdoors, often referred to as "web shells." Once installed, these web shells provide attackers with a graphical, browser-based control panel, granting them permanent, remote administrative access to the compromised server. This allows them to pivot into internal networks, exfiltrate sensitive data, or deploy ransomware at their leisure. Recognizing the extreme risk, Wiz spent the period leading up to the public disclosure working in close coordination with the PHP development team, Cloudflare, and OpenAI to measure the impact, verify the efficacy of the patches, and ensure a coordinated release of information to the public.
The patches are now available, and the PHP development team has urged all users to upgrade to the latest versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the specific branch currently in use. Despite the availability of these fixes, experts anticipate that the patching process will be a long and difficult road for many organizations. The situation has drawn inevitable comparisons to the infamous Log4Shell vulnerability of 2021, which paralyzed thousands of organizations due to the deep, often hidden integration of the Log4j logging framework in enterprise software.
"A vulnerability in core PHP reaches far beyond a single application," the researchers at Wiz noted in their technical analysis. "PHP runs across clouds, hosting providers, content-delivery networks, and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."
The ripple effects of the disclosure are still being measured. The SANS Internet Storm Center is currently monitoring major software platforms and distributions as they ship updated PHP packages to their users. For instance, Ubuntu has already released updated versions of its PHP packages to mitigate the risk for its server base. For those looking for a deeper technical understanding of how these bugs function, companies such as Calif have published detailed, stylized breakdowns of the discovery timeline and the nature of the exploit, providing a roadmap for security teams tasked with auditing their own infrastructure.
As the day progresses, the digital landscape remains in a state of high alert. Security professionals are emphasizing that the window for remediation is closing rapidly as automated botnets begin to scan for unpatched servers. Because the vulnerabilities are rooted in the core of the language, there is no simple configuration change or temporary workaround that can fully secure a system; upgrading the core software is the only viable path to safety.
With millions of web properties needing immediate attention, the coming days will likely be characterized by intense efforts from system administrators and DevOps teams to audit their server stacks and apply the necessary updates. While the immediate danger is being addressed through emergency patching, the long-term impact of these vulnerabilities—and the role that AI played in uncovering them—is expected to be a subject of intense discussion within the security community for years to come. This remains a fast-moving, evolving story, and organizations are advised to monitor official security advisories and the PHP project website for any further instructions or secondary updates.
