Expect to see quite a few websites serving error pages today as administrators scramble to apply emergency patches. Nearly 70 percent of websites globally need to update their core software immediately to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Cybersecurity experts confirm that working exploits for these flaws already exist in the wild, and malicious actors are actively targeting vulnerable infrastructure.
The flaws at issue are present in PHP, the ubiquitous programming language that powers sites running on a vast number of web publishing systems, content management platforms, and frameworks, including Drupal, Magento, Joomla, and WordPress. In response to the crisis, PHP released an emergency security update earlier today to fix two critical bugs that can allow an unauthorized remote attacker to execute arbitrary code of their choosing on any vulnerable web server.
The immediate fallout has been swift and visible. Reuters reports that government websites in Europe and various other regions went offline today after the PHP vulnerabilities were publicly disclosed. Meanwhile, major internet infrastructure and security companies have moved quickly to mitigate the threat. Cloudflare announced that it has already detected active exploitation of the flaws. At 3:02 am UTC, the company implemented specialized web application firewall (WAF) rules designed to protect customer websites from incoming attack traffic seeking to exploit the bugs. Left unmitigated, these vulnerabilities can lead to severe operational disruptions, including denial of service conditions, remote code execution, and unauthorized data exposure.
The discovery and disclosure of these zero-day bugs involved a coordinated effort among major technology firms and artificial intelligence pioneers. OpenAI, which participated directly in the vulnerability research and outreach, stated that given the sheer severity of these flaws and PHP’s massive, foundational footprint across the global internet, it considers this security issue to be one of the most impactful in recent memory.
Statistical data underscores the staggering scale of the potential attack surface. Censys, a security firm that continuously tracks the technologies utilized by internet-facing hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP. Furthermore, security researchers at Wiz noted that virtually every version of PHP released within the last decade is affected by at least one of these critical vulnerabilities.
In a comprehensive blog post published today, a team of researchers at Wiz—who were among the several organizations credited with discovering the flaws—emphasized the historical significance of the event, describing the findings as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software development.
According to the Wiz research team, the underlying code flaws had actually been present in the software for decades. However, demonstrating their exploitability previously required an exceptionally complex chain of steps, sitting right at the edge of what human security researchers could practically achieve. The introduction of frontier artificial intelligence models substantially reduced that technical barrier, effectively turning a longstanding, theoretical software flaw into a functional and dangerous exploit.
Wiz researchers warn that it is highly likely these PHP vulnerabilities will be subjected to mass-exploitation campaigns aimed at installing web-based backdoors, commonly known as "web shells." These malicious panels provide attackers with a convenient web-based interface that allows them to maintain persistent, remote control over infected websites and underlying servers. Prior to the public disclosure of the PHP bugs, Wiz worked closely with the core PHP development team, Calif, and OpenAI to accurately measure the scope of the problem, verify patches, and coordinate responsible disclosure.
The critical PHP zero-day vulnerabilities are being tracked officially by their Common Vulnerabilities and Exposures (CVE) numbers: CVE-2026-109618 and CVE-2026-109619. They impact all web servers running PHP versions 5.4 or later. To remediate the issues, administrators must upgrade to the newly released patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Because PHP is so deeply embedded into the architecture of modern web applications, Wiz experts warn that organizations will likely struggle to patch these vulnerabilities for a considerable amount of time. They have drawn direct comparisons between this critical PHP vulnerability pair and the infamous Log4Shell weakness that emerged in 2021—a similarly widespread and severe security flaw found in Log4j, a popular Java logging framework.
A vulnerability in core PHP reaches far beyond a single application or specific website, the Wiz researchers explained. PHP runs across multi-cloud environments, dedicated hosting providers, content delivery networks, and millions of independently managed servers. Reducing exposure and distributing patches before technical details became public required an unprecedented, coordinated effort across that entire interconnected ecosystem.
In the wake of the disclosures, the SANS Internet Storm Center has been closely monitoring major software platforms and Linux distributions as they ship updated packages to address the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For organizations seeking a technical deep-dive into the vulnerabilities, including a timeline of how the bugs were discovered presented in a unique comic book style, security firm Calif—another organization credited with finding the flaws—has published a detailed technical overview.
As this remains a fast-moving story with global implications, further updates regarding patch availability, threat intelligence, and mitigation strategies will continue to develop.
