Expect to see quite a few websites serving error pages and going offline today, as a massive global scramble begins to patch a pair of critical vulnerabilities impacting the core of the internet’s infrastructure. Nearly 70 percent of websites worldwide rely on core software updates to fix two severe security flaws that allow an attacker to seize full control over affected servers. Cybersecurity experts confirm that working exploits for these vulnerabilities already exist and that these critical bugs are actively being exploited in the wild, triggering emergency measures from governments, hosting providers, and cloud security firms alike.
The flaws at issue reside within PHP, the ubiquitous scripting and programming language that powers a vast ecosystem of web publishing systems, content management systems, and e-commerce platforms, including Drupal, Magento, Joomla, and WordPress. In response to the immediate threat, the PHP development team released an emergency security update earlier today designed to patch two critical bugs that can allow an authenticated or unauthenticated attacker, depending on the vector, to execute arbitrary code of their choosing on any vulnerable web server.
The global impact was immediate and tangible. Reuters reports that various government websites in Europe and other regions went offline temporarily as administrators rushed to take systems down or apply emergency patches following the public disclosure of the PHP vulnerabilities. Meanwhile, cloud infrastructure and security provider Cloudflare reported that it had already detected active exploitation of the flaws in the wild. Prompted by this activity, Cloudflare implemented specialized web application firewall rules to protect customer websites from incoming attack traffic seeking to exploit the bugs, which security researchers warn could trigger denial of service conditions, remote code execution, and sensitive data exposure.
Artificial intelligence pioneer OpenAI was closely involved in the vulnerability research and subsequent coordination efforts surrounding the discovery. In a public statement released alongside the patches, OpenAI noted that given the extreme severity of these flaws and PHP’s remarkably widespread deployment across the modern internet, they consider this security issue to be one of the most impactful and dangerous vulnerabilities in recent memory.
Internet scanning and attack-surface management firm Censys conducted a rapid analysis following the disclosure to gauge the potential blast radius. According to Censys, a recent global scan identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP. The sheer magnitude of these numbers underscores the immense logistical challenge facing system administrators, managed hosting providers, and enterprise IT departments tasked with rolling out emergency patches before malicious actors can weaponize the flaws at scale.
Security analysts at Wiz elaborated further on the broad reach of the issue, noting that virtually every single version of PHP released over the last decade is affected by at least one of these critical vulnerabilities.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” reads a detailed blog post published by a team of researchers at Wiz, which was one of several key organizations credited with discovering the vulnerabilities alongside OpenAI and other partners. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
The Wiz researchers warned that it is highly likely the newly disclosed PHP vulnerabilities will be weaponized for mass-exploitation campaigns. Specifically, attackers are expected to leverage the flaws to install web-based backdoors, commonly referred to as “web shells.” These malicious scripts provide attackers with a discrete web-based administrative panel, allowing them to maintain persistent, remote control over compromised sites even after initial patches might be applied if proper remediation steps are missed. Prior to the public disclosure of the PHP bugs, Wiz coordinated closely with the PHP core development team, technology firm Calif, and OpenAI to measure the true scale of the problem, verify patches, and ensure a structured, responsible disclosure timeline.
The PHP zero-day vulnerabilities are currently being tracked under official Common Vulnerabilities and Exposures designations as CVE-2026-109618 and CVE-2026-109619. These critical bugs affect all web servers running PHP 5.4 or later. The PHP development team has addressed and resolved the issues in newly released versions, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Upgrading to these patched versions immediately is considered mandatory for any organization operating a PHP-backed server.
Due to the deep integration of PHP within modern software stacks, Wiz cautions that organizations will likely struggle to patch these vulnerabilities completely for months, or even years, to come. Security analysts have drawn direct comparisons between this unfolding PHP crisis and the infamous Log4Shell weakness that emerged in late 2021—a similarly pervasive, high-severity security flaw that impacted the Log4j Java logging framework and sent shockwaves through enterprise IT environments globally.
“A vulnerability in core PHP reaches far beyond a single application,” the Wiz researchers wrote in their technical advisory. “PHP runs across clouds, hosting providers, content-delivery networks, and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem.”
As the situation continues to evolve, the SANS Internet Storm Center is actively monitoring the software supply chain, tracking major operating systems and web platforms as they ship updated packages to address the PHP flaws. For instance, Ubuntu and other major Linux distributions have already begun releasing updated PHP packages to safeguard their user bases. For administrators seeking a technical deep-dive into the mechanics of these vulnerabilities, along with a historical timeline of how the bugs were discovered presented in a comic-book style format, technology company Calif has published a dedicated analysis on its platform.
Security operations centers and web administrators are advised to monitor official channels, apply the latest vendor patches immediately, and review access logs for signs of anomalous activity. As this remains a fast-moving and fluid news story, further technical details and updates will be provided as they emerge.
