Expect to see quite a few websites serving error pages today, as nearly 70 percent of websites worldwide face an urgent need to update their core software to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that working exploits for these critical bugs already exist and that the flaws are actively being exploited in the wild, prompting government agencies, cloud infrastructure providers, and software maintainers to scramble for defenses.
The vulnerabilities at the center of the global alert reside within PHP, the foundational programming language that powers a vast ecosystem of web publishing systems, content management platforms, and applications. Sites running on popular frameworks and platforms including Drupal, Magento, Joomla, and WordPress are heavily reliant on the language. Earlier today, the PHP development team released an emergency security update designed to patch two critical bugs capable of allowing an unauthenticated attacker to execute arbitrary code of their choosing on any vulnerable web server.
The fallout from the disclosure was immediate. Reuters reports that government websites in Europe and various other regions went offline today as administrators preemptively took systems offline or grappled with active disruptions following the public revelation of the PHP vulnerabilities. Meanwhile, infrastructure and security giant Cloudflare reported that it had already detected active exploitation attempts targeting the flaws. In response, Cloudflare implemented specialized web application firewall rules at 3:02 am UTC to shield customer websites from incoming attack traffic seeking to exploit the bugs, which carry severe risks including denial-of-service conditions, remote code execution, and unauthorized data exposure.
The severity of the situation has drawn warnings from major technology players. OpenAI, which was directly involved in the vulnerability research and subsequent coordinated outreach efforts, stated that given the sheer severity of these flaws and the ubiquitous nature of PHP across the modern internet, they consider this security issue to be one of the most impactful in recent memory.
The scale of the potential attack surface is immense. According to Censys, a specialized firm that tracks internet-facing technology and hosts, a recent scanning sweep identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million web properties currently running PHP. Security researchers at Wiz added further gravity to the picture, noting that virtually every PHP version released over the past decade is affected by at least one of these core vulnerabilities.
Describing the unprecedented nature of the discovery, a team of researchers at Wiz—who were credited alongside other organizations for finding the bugs—published a detailed blog post highlighting the technical barriers that were overcome. These findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in software history, the researchers wrote. The underlying flaws had reportedly been present in the language’s codebase for decades, but demonstrating their exploitability required an exceptionally complex chain of steps that pushed right up against the edge of what human researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that barrier, effectively transforming a longstanding, theoretical flaw into a functional, highly dangerous exploit.
Furthermore, the Wiz researchers warned that it is highly likely these PHP vulnerabilities will be mass-exploited by malicious actors seeking to install web-based backdoors or web shells. These malicious interfaces provide attackers with a discrete web-based control panel, granting them persistent remote command over infected servers and the websites they host. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, technology firm Calif, and OpenAI to measure the true magnitude of the problem, verify patches, and coordinate a responsible disclosure timeline.
The zero-day vulnerabilities are being tracked officially under CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP versions 5.4 or later. To mitigate the risk, administrators must upgrade immediately to the newly issued patches, which are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply embedded into the architecture of modern web applications, security professionals warn that organizations will likely struggle to patch these vulnerabilities for a prolonged period. Analysts have drawn direct comparisons between this critical PHP vulnerability pair and the infamous Log4Shell weakness that emerged in late 2021—a widespread and severe security flaw found in Log4j, a popular Java logging framework that kept defenders occupied for months and years afterward.
A vulnerability in core PHP reaches far beyond any single application, the Wiz researchers emphasized. PHP runs seamlessly across cloud environments, hosting provider backends, content-delivery networks, and millions of independently managed servers worldwide. Reducing exposure and distributing patches before the technical details became public required an unprecedented, coordinated effort across that entire global technology ecosystem.
Meanwhile, monitoring bodies like the SANS Internet Storm Center are keeping a close watch on major software platforms and Linux distributions that are rapidly shipping updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. Organizations seeking a technical deep-dive into the mechanics of the vulnerabilities, alongside a chronicle of the discovery timeline presented in a unique format, can consult documentation provided by Calif, another technology company credited with unearthing the flaws.
As system administrators around the globe race to apply emergency updates and review server logs for signs of compromise, the situation remains fluid. Further updates from security vendors, software distributors, and monitoring agencies are expected as the digital landscape adjusts to the fallout of one of the most significant software security events in recent history.
