Expect to see a significant number of websites serving error pages today as administrators scramble to address a pair of severe vulnerabilities within the PHP programming language. Nearly 70 percent of all websites currently on the internet rely on PHP to power their core operations, and security researchers have confirmed that these newly disclosed flaws allow an attacker to seize full, unmitigated control over affected servers. Perhaps most alarmingly, cybersecurity experts have confirmed that working exploits for these bugs are not just theoretical; they are already being actively utilized by malicious actors in the wild.
The vulnerabilities are rooted in the core of PHP, the ubiquitous scripting language that serves as the backbone for a vast ecosystem of web publishing platforms, content management systems, and enterprise frameworks. Popular systems including Drupal, Magento, Joomla, and WordPress—which collectively power a significant portion of the modern web—are directly affected by these flaws. In response to the crisis, the PHP development team released an emergency security update earlier today to remediate two critical vulnerabilities that grant unauthorized parties the ability to execute arbitrary code of their choosing on a vulnerable server, potentially leading to a complete compromise of data and infrastructure.
The impact is already being felt globally. Reuters has reported that government websites across Europe and other regions were taken offline earlier today as agencies scrambled to mitigate the risk following the public disclosure of the vulnerabilities. Major infrastructure providers have also stepped in to provide a layer of defense. Cloudflare, one of the world’s largest content delivery networks, confirmed that it had already detected exploitation attempts targeting the flaws. At 3:02 am UTC, the company implemented specialized web application firewall (WAF) rules designed to intercept and block attack traffic aimed at these vulnerabilities, which the company noted could lead to denial-of-service conditions, unauthorized remote code execution, and widespread data exposure.
The severity of this situation is difficult to overstate. OpenAI, which participated in the vulnerability research and subsequent outreach, issued a statement calling the situation "one of the most impactful security issues in recent memory," citing both the inherent danger of the flaws and the near-universal reliance on PHP across the internet.
The scope of the potential damage is massive. Censys, a firm that specializes in tracking the technology stacks of internet-facing hosts, conducted a scan that identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million web properties that rely on PHP. The exposure is effectively global, touching virtually every sector of the digital economy.
Security researchers at Wiz, who were instrumental in the discovery and coordinated disclosure of these vulnerabilities, noted that every single version of PHP released in the last decade is affected by at least one of these two flaws. In a detailed blog post published alongside the disclosure, the Wiz research team described the bugs as some of the most dangerous in the history of the language.
"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," the researchers wrote. "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."
This detail—that AI was used to bridge the gap between a dormant, complex logic error and a functional, dangerous exploit—marks a significant shift in the threat landscape. The researchers at Wiz warn that it is highly probable the PHP vulnerabilities will be subject to mass exploitation. Attackers are likely to use these entry points to install persistent web-based backdoors, often referred to as "web shells." These tools provide a graphical, web-based control panel that allows hackers to remotely manage infected servers, exfiltrate sensitive databases, or use the compromised infrastructure to launch further attacks.
To manage the fallout, Wiz coordinated closely with the PHP development team, the research firm Calif, and OpenAI to measure the scale of the risk and ensure that patches could be verified and deployed before the technical details became public. These efforts were crucial to mitigating what could have been a catastrophic, instantaneous wave of global compromise.
The vulnerabilities, tracked under the CVE identifiers CVE-2026-109618 and CVE-2026-109619, affect all web servers running PHP 5.4 or later. Security administrators and web hosts are being urged to upgrade immediately. The vulnerabilities have been addressed in the latest releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Wiz researchers have drawn comparisons between this incident and the 2021 Log4Shell crisis—a vulnerability in the Log4j Java logging framework that was similarly widespread and required a massive, industry-wide effort to remediate. Because PHP is so deeply embedded into the architecture of modern web applications, the remediation process is expected to be lengthy and arduous.
"A vulnerability in core PHP reaches far beyond a single application," the Wiz researchers noted. "PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."
The SANS Internet Storm Center is currently monitoring the situation, keeping a close eye on major software vendors and Linux distributions as they release updated PHP packages to their respective repositories. Ubuntu, for instance, has already moved to release updated packages to protect its user base. For those seeking a technical breakdown of the discovery, the security firm Calif has published a detailed account of the research process, presented in a unique, narrative-driven format that documents the timeline of the vulnerabilities.
As the situation develops, organizations are being advised to prioritize the patching of internet-facing servers. The ease with which these vulnerabilities can be weaponized means that any delay in updating infrastructure leaves a window of opportunity for attackers to gain a foothold. Censys has even established a dedicated portal to track the prevalence of the vulnerabilities, providing a stark visualization of how many web properties remain in a state of potential compromise.
This remains a rapidly evolving situation. As more organizations perform internal audits and discover the extent to which their systems rely on legacy or unpatched versions of PHP, the number of sites taken offline for emergency maintenance is expected to climb. For web administrators, the focus is now entirely on patch management and incident response, as the security community remains on high alert for further evidence of malicious activity targeting these critical flaws. The incident serves as a sobering reminder of the fragility of the web’s core infrastructure and the ongoing challenges of maintaining security in a deeply interconnected digital environment.
