Expect to see a significant increase in error pages, maintenance notifications, and service disruptions across the internet today. A massive, industry-wide mobilization is currently underway as administrators scramble to update the core software powering nearly 70 percent of the world’s websites. The urgency follows the disclosure of two critical vulnerabilities within PHP, the ubiquitous programming language that serves as the backbone for a vast array of web publishing systems, including WordPress, Drupal, Joomla, and Magento.
The security flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are not merely theoretical risks. Cybersecurity experts have confirmed that functional exploits for these bugs are already circulating, and there is clear evidence that they are being actively leveraged by attackers in the wild. If successfully exploited, these vulnerabilities allow an unauthorized actor to seize full, remote control over an affected server, potentially leading to total system compromise, data theft, and the installation of persistent backdoors.
The scale of the potential fallout is immense. According to data provided by Censys, a company that monitors the global internet landscape, there are approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties currently running PHP. Because PHP is so deeply integrated into the fabric of the modern web, the challenge of patching these systems is expected to be a long-term burden for organizations worldwide. Some analysts are already drawing comparisons to the infamous Log4Shell vulnerability of 2021, which similarly forced a global, high-stakes race to secure a foundational piece of internet infrastructure.
The severity of the situation has prompted an unprecedented level of coordination between software developers, AI research firms, and security vendors. OpenAI, which contributed to the vulnerability research and outreach process, issued a stark warning regarding the impact of the discovery. "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory," the company stated in a formal release.
The path to discovering these vulnerabilities marks a significant milestone in the evolution of cyber warfare and defense. Researchers at Wiz, one of the organizations credited with identifying the flaws, noted that the underlying issues had technically existed for decades. However, the complexity required to weaponize them was historically considered to be beyond the reach of most human actors. It was only through the application of frontier AI models—which acted as a force multiplier—that the barriers to creating a working exploit were overcome.
"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," the Wiz team wrote in a technical analysis published today. "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."
The primary concern for security professionals is the ease with which these vulnerabilities could be used to deploy "web shells." A web shell is essentially a malicious, web-accessible control panel that grants an attacker persistent, remote command-line access to a server. Once such a backdoor is installed, the attacker can maintain control over the site even after initial patches are applied, unless the server is thoroughly audited and cleaned.
The ripples of this disclosure were felt almost immediately across the globe. Reuters reported that several government websites in Europe and other regions were taken offline as a precautionary measure immediately following the news of the vulnerabilities. Major infrastructure providers like Cloudflare have also swung into action; the company reported that it began detecting attempts to exploit the flaws well before the public disclosure. By 3:02 am UTC, Cloudflare had already implemented specialized web application firewall (WAF) rules designed to intercept and neutralize attack traffic attempting to trigger the bugs, which can result in denial-of-service conditions, remote code execution, and mass data exposure.
The PHP development team has responded with an emergency security update. The vulnerabilities affect all web servers running PHP 5.4 or later, and the necessary patches are now available in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Because the vulnerability lies within the core language, the impact is not limited to any single application or framework; it affects everything from cloud-based hosting providers and content delivery networks to independently managed servers.
"A vulnerability in core PHP reaches far beyond a single application," the Wiz researchers noted. "PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."
The coordination mentioned by the researchers involved extensive pre-disclosure communication between the PHP team, security vendors like Wiz and Calif, and AI entities like OpenAI. This allowed for the development of protective measures and the synchronization of patch availability to minimize the window of opportunity for malicious actors.
As the day progresses, the SANS Internet Storm Center is continuing to monitor the situation, tracking how major software platforms and distributions respond to the threat. For instance, Ubuntu has already released updated PHP packages to accommodate the fixes, and other distributions are expected to follow suit rapidly. For technical teams seeking a deeper understanding of the mechanics behind the vulnerabilities, Calif has published a detailed breakdown of the discovery timeline, presented in a unique, accessible format.
For most web administrators, the task ahead is clear: verify the version of PHP currently running on their infrastructure and update to the patched versions immediately. However, the sheer ubiquity of PHP means that many legacy systems, custom-built applications, and neglected servers may remain vulnerable for weeks or months to come. Security experts warn that the window of active exploitation is currently wide open, and the coming days will likely see an uptick in automated scans as attackers look for unpatched, high-value targets.
Organizations are advised to prioritize the patching of internet-facing servers, review access logs for signs of unauthorized activity, and ensure that backups are isolated and secure. As the internet community grapples with the fallout, the discovery of these PHP flaws serves as a sobering reminder of how fragile the digital ecosystem remains, even as the tools used to identify—and exploit—its weaknesses become increasingly sophisticated. This is a fast-moving situation, and further updates regarding the scope of exploitation and the success of the patching efforts are expected to emerge as the story develops.
