Expect to see a significant wave of error pages, offline services, and frantic administrative scrambling across the internet today, as roughly 70 percent of all websites face an urgent requirement to update their core software. This massive disruption stems from a newly disclosed pair of critical vulnerabilities in PHP, the foundational programming language that drives a vast portion of the modern web. The flaws allow an unauthenticated attacker to seize complete, unhindered control over affected web servers. According to cybersecurity experts and threat intelligence groups, working exploits for these vulnerabilities are not only circulating in security research circles, but these critical bugs are already being actively exploited in the wild.
The vulnerabilities reside deep within PHP, making them exceptionally far-reaching. PHP serves as the underlying engine for an enormous ecosystem of content management systems, web publishing platforms, and e-commerce frameworks, including widely deployed systems like WordPress, Drupal, Joomla, and Magento. In response to the crisis, the PHP development team released an emergency security update earlier today designed to patch the two critical bugs. These vulnerabilities can enable a malicious actor to execute arbitrary code of their choosing directly on a vulnerable web server, paving the way for complete system compromise.
The real-world fallout was immediate and widespread. Reuters reported that numerous government websites in Europe and across other regions went offline earlier today following the public disclosure of the PHP vulnerabilities. Meanwhile, cloud infrastructure and security provider Cloudflare announced that it had already detected active exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall (WAF) rules designed to protect client websites from incoming malicious traffic attempting to leverage the bugs. According to technical assessments, these vulnerabilities are capable of triggering severe consequences, including denial of service conditions, remote code execution, and unauthorized data exposure.
The severity and broad implications of the discovery prompted unusual cross-industry collaboration. OpenAI, which participated directly in the vulnerability research and subsequent coordination efforts, issued a public statement emphasizing the gravity of the situation. Given the extraordinary severity of these flaws coupled with the ubiquity of PHP across global infrastructure, OpenAI stated that it considers this development to be one of the most impactful security issues witnessed in recent memory.
Market data underscores the immense scale of the potential attack surface. Censys, a security firm that continuously monitors and tracks technology deployments across internet-facing hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP. Furthermore, security researchers at Wiz noted that virtually every version of PHP released over the past decade is affected by at least one of these critical vulnerabilities.
The discovery process itself represents a watershed moment in cybersecurity, highlighting how advanced technology is reshaping both threat vectors and defensive research. In a published blog post detailing the findings, the research team at Wiz—one of several organizations credited with discovering the vulnerabilities—described the situation in stark terms. They noted that these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software development as a whole.
According to the Wiz researchers, the underlying software flaws had actually been present within the PHP codebase for decades. However, demonstrating their exploitability previously required an exceptionally complex, multi-stage chain of steps that sat right at the absolute edge of what human security researchers could practically achieve. The introduction of frontier artificial intelligence models substantially reduced that barrier, turning a long-standing, theoretical architectural flaw into a functional, weaponized exploit.
The Wiz team warned that it is highly probable these PHP vulnerabilities will face automated, mass exploitation campaigns designed to install web-based backdoors, commonly known as web shells. These malicious interfaces provide attackers with a discrete web-based administrative panel that grants them persistent, remote control over infected websites. Prior to the public disclosure of the bugs, Wiz coordinated closely with the core PHP development team, Calif, and OpenAI to accurately measure the scope of the problem, verify effective patches, and orchestrate a responsible disclosure timeline.
The zero-day vulnerabilities are officially being tracked under common vulnerabilities and exposures identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP version 5.4 or later. To remediate the flaws, administrators must immediately update their installations to the newly released versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Because PHP is so deeply interwoven into the architecture of modern web applications, security professionals warn that organizations will likely struggle with the patching process for an extended period. Many industry experts are drawing direct comparisons between this unfolding PHP crisis and the infamous Log4Shell vulnerability that emerged in late 2021—a similarly pervasive and critical flaw found in the Log4j Java logging framework.
As the Wiz researchers pointed out, a vulnerability residing in core PHP reaches far beyond any single web application or hosting provider. PHP operates across multi-cloud environments, independent hosting providers, massive content delivery networks, and millions of independently managed web servers worldwide. Achieving risk reduction and closing exposure gaps before technical exploit details became publicly available required unprecedented, synchronized cooperation across the entire global web ecosystem.
Monitoring organizations and incident response groups are working around the clock to track the situation. The SANS Internet Storm Center is closely monitoring major software vendors and Linux distributions as they rush to ship updated packages to address the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its users. Meanwhile, technology company Calif—another key organization credited with discovering the vulnerabilities—published a technical deep-dive detailing the history and discovery timeline of the bugs in a distinctive, comic-book-style presentation.
As system administrators and webmasters worldwide scramble to apply the emergency patches, the digital landscape remains on high alert. The situation continues to evolve rapidly as automated scanning and exploitation attempts increase across the public internet.
