Web administrators worldwide are rushing to deploy emergency updates today following the disclosure of a pair of critical vulnerabilities affecting the PHP programming language. Nearly 70 percent of websites face potential disruption or total compromise unless core software updates are applied immediately. Security experts report that working exploits for the flaws are already circulating and that malicious actors are actively leveraging the bugs in the wild, allowing attackers to seize full control over vulnerable web servers.
The security crisis centers on PHP, a foundational programming language that powers a vast ecosystem of content management systems and web publishing platforms, including WordPress, Drupal, Magento, and Joomla. In response to the discovery, PHP maintainers released an emergency security update earlier today to patch two severe bugs that enable unauthenticated remote code execution. These flaws allow an attacker to execute arbitrary code of their choosing on any server running an unpatched version of the software.
The impact of the disclosure was felt almost immediately across the globe. According to reports from Reuters, government websites in Europe and various other international jurisdictions were forced offline as administrators scrambled to address the risk before malicious actors could compromise critical infrastructure. Meanwhile, infrastructure and security providers have mobilized to mitigate the threat. Cloudflare announced that it has already detected active exploitation attempts targeting the vulnerabilities. At 3:02 am UTC, the company implemented specialized web application firewall rules to intercept attack traffic designed to trigger denial-of-service conditions, execute remote code, or expose sensitive data.
The severity of the situation has drawn warnings from major technology companies involved in identifying and analyzing the issue. OpenAI, which participated in the coordinated vulnerability research and outreach, stated that given the sheer scale of PHP’s deployment and the severity of the flaws, it considers this security incident to be one of the most impactful events in recent memory.
Internet scanning and telemetry data highlight the staggering scale of the potential attack surface. Censys, a firm that tracks technology infrastructure across the internet, reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Furthermore, security researchers at Wiz noted that virtually every version of PHP released over the last decade is affected by at least one of these critical vulnerabilities.
Describing the technical breakthrough behind the discovery, researchers at Wiz characterized the findings as ranking among the most severe vulnerabilities ever uncovered in PHP software history. In a blog post published today, the Wiz research team explained that the underlying flaws had actually been present within the language for decades. However, demonstrating that the bugs could be successfully exploited previously required an exceptionally complex chain of steps, sitting at the very edge of what human researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that technical barrier, transforming a longstanding, theoretical flaw into a viable and dangerous exploit.
Security analysts at Wiz warned that the PHP vulnerabilities are highly likely to be subjected to mass exploitation campaigns aimed at installing web-based backdoors, commonly known as web shells. These malicious interfaces provide attackers with a convenient web-based control panel, granting them persistent remote access to manipulate infected websites at will. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP development team, security firm Calif, and OpenAI to measure the true magnitude of the problem, verify patches, and coordinate responsible disclosure.
The zero-day vulnerabilities are officially tracked under the identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or any subsequent version. The core development team has addressed the issues in newly released versions, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply integrated into the architecture of modern web applications and hosting environments, security professionals anticipate that organizations will struggle to apply patches comprehensively for an extended period. Some analysts have drawn parallels between this current PHP crisis and the infamous Log4Shell vulnerability that emerged in 2021, which exposed a deeply embedded and severe flaw in the Log4j Java logging framework.
A vulnerability residing in core PHP reaches far beyond any single application or framework, the Wiz researchers emphasized. PHP operates across complex cloud infrastructures, major hosting providers, content-delivery networks, and millions of independently administered servers. Mitigating exposure before the technical details became public required an unprecedented level of coordinated cooperation across the entire web ecosystem.
Monitoring organizations are actively tracking the rollout of updates. The SANS Internet Storm Center is closely observing major software platforms and distribution channels as they ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages to safeguard its user base. Organizations seeking a technical deep-dive into the vulnerabilities, alongside a detailed timeline of how the bugs were discovered presented in a comic book style, can review publications from Calif, another technology company credited with playing a key role in finding the PHP flaws. As this remains a fast-moving security event, further updates and telemetry figures are expected to emerge as administrators continue assessing their systems.
