Web administrators around the globe are rushing to apply emergency security updates as a pair of critical vulnerabilities in PHP—the programming language powering a vast majority of the internet—actively threatens servers worldwide. Security experts warn that roughly seventy percent of websites may need immediate core software updates to fix the flaws, which grant attackers the ability to seize full control over affected systems. With working exploits already circulating, organizations face a race against time to patch their servers before malicious actors can leverage the bugs to launch widespread attacks.
The high-severity issues reside directly within the core of PHP, a foundational scripting language that drives countless web publishing platforms, content management systems, and enterprise tools, including WordPress, Drupal, Magento, and Joomla. In response to the discovery, the PHP development team issued emergency patches. However, because the programming language is so deeply embedded into the architecture of modern web infrastructure, remediation is expected to be a prolonged and complex challenge for system administrators across every industry.
Government websites in Europe and other regions began experiencing unexpected outages shortly after the vulnerabilities were publicly disclosed. Meanwhile, major infrastructure and security firms have mobilized to protect their networks. Cloudflare reported that its systems detected exploitation attempts shortly after disclosure, prompting the company to implement automated web application firewall rules at 3:02 am UTC to intercept malicious traffic. These protective measures are designed to shield web properties from attack vectors targeting the bugs, which could otherwise lead to severe consequences such as denial-of-service conditions, remote code execution, and unauthorized data exposure.
The severity and broad implications of the discovery have drawn concern from leading technology organizations, including OpenAI, which participated directly in the vulnerability research and coordinated disclosure efforts. In a public statement regarding the incident, OpenAI noted that given the immense scope of PHP’s deployment across the internet and the critical nature of the flaws, the situation represents one of the most impactful security issues witnessed in recent memory.
The scale of the potential fallout is vast. According to recent scanning data from internet infrastructure tracking firm Censys, approximately 2.58 million internet-facing hosts and roughly 54.9 million individual web properties currently run PHP. Furthermore, security researchers at Wiz indicated that virtually every version of PHP released over the past decade is affected by at least one of these two vulnerabilities.
The Wiz research team, which was among several organizations credited with discovering the security gaps, emphasized the unprecedented nature of the flaws in a detailed advisory. They noted that the underlying weaknesses had technically been present in the software for decades, but developing a functional, reliable exploit required an exceptionally complex chain of steps that previously stretched the limits of what human security researchers could practically achieve. According to Wiz, the introduction of frontier artificial intelligence models substantially reduced that technical barrier, effectively transforming a longstanding, theoretical flaw into a dangerous, weaponized exploit.
Security analysts predict that the vulnerabilities will likely face mass exploitation by cybercriminals seeking to install web-based backdoors, commonly referred to as web shells. These malicious interfaces provide attackers with a convenient web-based administrative panel, allowing them to maintain remote control over compromised servers indefinitely. Prior to the public disclosure, Wiz collaborated closely with the PHP security team, technology firm Calif, and OpenAI to measure the true extent of the problem, verify patches, and coordinate a safe disclosure timeline.
The zero-day vulnerabilities are officially tracked under the Common Vulnerabilities and Exposures system as CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP versions 5.4 and later. To remediate the risks, administrators must update their environments to the newly released patched versions, which include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP serves as the underlying engine for so many interconnected web applications, industry analysts have drawn comparisons between this crisis and the infamous Log4Shell weakness that emerged in late 2021. Log4Shell exposed a pervasive vulnerability in a widely used Java logging framework, creating years of remediation headaches for enterprise security teams. Experts point out that a core vulnerability in PHP reaches far beyond any single application or platform, impacting cloud environments, third-party hosting providers, content delivery networks, and millions of independently managed servers alike. Successfully mitigating exposure before technical details became public required an unprecedented level of coordination across the entire web ecosystem.
Monitoring agencies and technical organizations continue to track the unfolding situation closely. The SANS Internet Storm Center has raised its alert level while monitoring major software distributions and Linux vendors as they ship updated PHP packages to their users. For instance, Ubuntu has already rolled out updated PHP packages to help secure its user base. Meanwhile, technology firm Calif—another key participant in the discovery process—has published technical deep-dives and documentation tracing the timeline of how the bugs were uncovered.
As the situation develops, security professionals advise all web hosting providers, developers, and system administrators to prioritize applying the official PHP patches immediately to prevent unauthorized access and potential server takeover.
