Expect to see quite a few websites serving error pages and unexpected downtime today, as nearly 70 percent of websites worldwide are forced to rush core software updates to fix a devastating pair of vulnerabilities. These newly disclosed security flaws allow an unauthorized attacker to seize absolute, full control over affected servers. Cybersecurity experts monitoring the situation have confirmed that working exploits for the flaws are already publicly available and, worse still, that these critical bugs are actively being exploited in the wild by malicious actors.
The core flaws at issue are deeply embedded in PHP, the widely utilized server-side scripting language that serves as the backbone for a massive portion of the modern internet. PHP powers millions of sites running on popular web publishing systems, content management platforms, and e-commerce frameworks, including Drupal, Magento, Joomla, and WordPress. In response to the immediate and catastrophic threat, the PHP development team released an emergency security update earlier today to fix two critical zero-day bugs. These vulnerabilities can allow a remote attacker to execute arbitrary code of their choosing on any vulnerable web server, effectively opening the door to total system compromise.
International news outlets, including Reuters, report that government websites across Europe and various other regions went offline earlier today as system administrators scrambled to respond after the PHP vulnerabilities were publicly disclosed. Meanwhile, major cloud infrastructure and security provider Cloudflare announced that it had already detected active exploitation attempts targeting the flaws. Moving swiftly to protect its customers, Cloudflare implemented specialized web application firewall (WAF) rules to intercept attack traffic seeking to exploit the bugs. According to security advisories, these vulnerabilities can trigger severe consequences, including denial of service conditions, arbitrary remote code execution, and unauthorized data exposure.
Artificial intelligence research leader OpenAI, which played a direct role in the vulnerability research and coordinated disclosure efforts alongside cybersecurity firms, issued a stark assessment of the situation. Given the extreme severity of these flaws and the ubiquitous, foundational nature of PHP’s deployment across the global web, OpenAI stated that it considers this development to be one of the most impactful and dangerous security issues in recent memory.
Censys, a specialized technology company that continuously tracks and maps the software used by internet hosts and connected infrastructure, reported that a recent scan identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP. The sheer breadth of this ecosystem means that millions of digital assets are potentially exposed to hostile actors until patches can be successfully applied.
Security analysts at Wiz added further context to the scale of the crisis, noting that virtually every single PHP version released over the past decade is affected by at least one of these two critical vulnerabilities.
Describing the unprecedented nature of the discovery, a team of researchers at Wiz published a detailed blog post highlighting the technical marvel and danger behind the event. These findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the entire history of software development. According to the Wiz research team, the underlying flaws had actually been present within the code base for decades, lying dormant and hidden from human eyes. Demonstrating their exploitability required an exceptionally complex chain of steps, pushing right up against the absolute edge of what human security researchers could practically achieve on their own. However, the integration of frontier AI models substantially reduced that technical barrier, effectively turning a longstanding, theoretical flaw into a functional and devastating exploit.
The Wiz researchers warn that it is highly probable the PHP vulnerabilities will be weaponized in mass-exploitation campaigns. Attackers are expected to leverage the flaws to install persistent, web-based backdoors or web shells. These malicious interfaces provide attackers with a discrete, browser-based management panel that grants them long-term, remote control over compromised websites and servers. Prior to the public disclosure of the bugs, Wiz worked collaboratively with the core PHP development team, security firm Calif, and OpenAI to measure the true magnitude of the problem, verify patches, and coordinate a safe, responsible disclosure timeline.
The critical PHP zero-day vulnerabilities are currently being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP 5.4 or any subsequent version released over the past ten years. The vulnerabilities have been officially resolved in newly released versions of the language, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
According to Wiz, PHP is so deeply woven into the fabric of modern web applications and server architectures that organizations will likely struggle to patch these vulnerabilities for a prolonged period. Industry analysts are already drawing direct comparisons between this current PHP crisis and the infamous Log4Shell weakness that emerged in late 2021. Log4Shell was similarly categorized as a widespread, maximum-severity security flaw affecting Log4j, a popular Java logging framework, which left organizations scrambling to find and remediate hidden instances across their enterprise networks for months.
A vulnerability residing in core PHP reaches far beyond any single application, content management system, or isolated server, the Wiz researchers explained. PHP operates seamlessly across complex cloud environments, specialized hosting providers, global content-delivery networks, and millions of independently managed servers. Drastically reducing exposure before technical exploitation details became public required an unprecedented, coordinated effort across that entire interconnected ecosystem.
Meanwhile, the SANS Internet Storm Center is closely monitoring the situation as major software vendors, Linux distributions, and hosting platforms rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base to mitigate the risk. Organizations seeking a technical deep-dive into the vulnerabilities, along with a chronological timeline of how the bugs were originally discovered presented in a unique comic book style, can review documentation published by security firm Calif, another technology organization credited with discovering the PHP flaws.
As system administrators, hosting providers, and enterprise security teams race against automated threat actors to secure their infrastructure, the situation remains fluid. This is a fast-moving story, and further updates regarding active exploits, patching efforts, and ecosystem impacts will be integrated as new information becomes available.
