Expect to see quite a few websites serving error pages today as a massive segment of the internet scrambles to address a pair of severe security flaws. Nearly 70 percent of websites worldwide need to update their core software immediately to fix two critical vulnerabilities that allow an unauthorized attacker to seize full control over affected servers. Cybersecurity experts report that working exploits for these flaws already exist in the wild and that malicious actors are actively exploiting the bugs against live targets across the global internet infrastructure.
The vulnerabilities at the center of this emergency response are present in PHP, one of the most widely used programming languages on the internet. PHP forms the foundational backend for a vast number of web publishing platforms, content management systems, and enterprise frameworks, including widely deployed systems like Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to patch the two critical bugs, which can permit a remote attacker to execute arbitrary code of their choosing on any vulnerable web server.
The global impact of the disclosure was felt almost immediately. Reuters reports that various government websites in Europe and across other regions went offline today as administrators scrambled to take systems offline or apply emergency patches after the PHP vulnerabilities were publicly disclosed. Meanwhile, major infrastructure and security providers have mobilized their defenses. Cloudflare announced that it has already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, the company implemented specialized web application firewall rules designed to protect client websites from incoming attack traffic attempting to leverage the bugs. According to technical assessments, these vulnerabilities can lead to severe operational consequences, including denial of service conditions, remote code execution, and unauthorized data exposure.
The discovery and disclosure process involved a coordinated effort among multiple major technology entities. OpenAI, which participated directly in vulnerability research and cross-industry outreach, emphasized the unprecedented nature of the discovery. Given the sheer severity of these flaws combined with the ubiquitous deployment of PHP across the modern web, the company stated that it considers this security issue to be one of the most impactful events in recent memory.
Internet scanning and telemetry firms have worked quickly to quantify the potential surface area of the threat. Censys, a company that continuously tracks technology stacks and internet-facing hosts, stated that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Furthermore, security researchers at Wiz reported that every single major version of PHP released over the last decade is affected by at least one of these critical vulnerabilities.
The Wiz research team, which was credited as one of the organizations that originally discovered the flaws, published a detailed blog post characterizing the severity of the situation. According to the researchers, these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software engineering. The underlying architectural flaws had quietly persisted within the language for decades, but demonstrating their exploitability previously required an exceptionally complex chain of steps sitting right at the absolute edge of what human researchers could practically achieve. However, the involvement of frontier artificial intelligence models substantially reduced that barrier, effectively turning a longstanding theoretical flaw into a functional, weaponized exploit.
Looking ahead, the Wiz researchers warned that it is highly likely these PHP vulnerabilities will be subjected to mass exploitation campaigns. Attackers are expected to leverage the flaws to install web-based backdoors or web shells, which provide malicious actors with a convenient web-based administrative panel enabling them to remotely control infected sites at scale. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem, verify patches, and coordinate a responsible disclosure timeline.
The PHP zero-day vulnerabilities are currently being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or any subsequent version. The emergency patches developed to remediate these issues have been officially released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Due to the deep integration of PHP across countless applications, libraries, and hosting environments, security analysts predict that organizations will struggle to patch these vulnerabilities for a considerable length of time. Industry experts have drawn direct comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that emerged in 2021, which introduced a widespread and severe security flaw into Log4j, a popular Java logging framework.
A vulnerability residing in core PHP reaches far beyond any single application or isolated system. PHP runs across multi-tenant clouds, specialized hosting providers, content-delivery networks, and millions of independently managed servers worldwide. Reducing overall exposure before technical details leaked into the wild required unprecedented, coordinated remediation work across the entire digital ecosystem.
Meanwhile, monitoring bodies like the SANS Internet Storm Center are keeping a close watch on major software vendors and operating system distributions as they ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. Organizations seeking a technical deep-dive into the vulnerabilities, including a narrative timeline of how the bugs were discovered presented in a comic book style, can review documentation published by Calif, another technology company credited with finding the flaws.
As this remains a fast-moving story, technical advisories, patch availability, and global mitigation efforts continue to evolve rapidly across the web infrastructure landscape.
