Expect to see quite a few websites serving error pages and going offline today, as system administrators around the world race to apply emergency software updates. Nearly 70 percent of websites globally are estimated to require core software updates to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts report that working exploits for the flaws are already active and that these critical bugs are actively being exploited in the wild, triggering widespread emergency responses from governments, cloud providers, and infrastructure companies.
The vulnerabilities at issue are deeply embedded in PHP, the foundational programming language that powers an enormous share of the modern web. This includes sites running on major web publishing systems, content management platforms, and e-commerce frameworks such as Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to fix two critical bugs. These vulnerabilities can allow an unauthorized remote attacker to execute arbitrary code of their choosing on any vulnerable web server, effectively granting them unrestricted access to the underlying system.
The fallout from the disclosure has already disrupted operations internationally. Reuters reports that government websites in Europe and various other regions went offline today immediately following the public disclosure of the PHP vulnerabilities. Meanwhile, major infrastructure and security firms have mobilized to mitigate the impact. Cloudflare stated that it has already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, the company implemented specialized web application firewall rules to protect customer websites from incoming attack traffic. According to Cloudflare, the attack vectors attempting to exploit these bugs are capable of causing denial-of-service conditions, remote code execution, and unauthorized data exposure.
OpenAI, which played a direct role in the vulnerability research and coordinated outreach efforts preceding the public disclosure, emphasized the historic nature of the threat. In a public statement, the company noted that given the extreme severity of these flaws and PHP’s overwhelmingly widespread use across the global internet, this ranks as one of the most impactful security issues in recent memory.
Internet scanning and telemetry firms have rushed to quantify the massive attack surface presented by the vulnerabilities. Censys, a company that tracks the technology stacks utilized by internet-facing hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Meanwhile, security researchers at Wiz noted that virtually every single version of PHP released over the last decade is affected by at least one of these two critical vulnerabilities.
The discovery process itself represents a notable milestone in cybersecurity history. In a blog post published today, a team of researchers at Wiz—who were among the multiple organizations credited with discovering the vulnerabilities—described the findings as ranking among the most severe ever uncovered in PHP and arguably in the history of software development. The Wiz researchers explained that the underlying flaws had actually been present within the language for decades. However, demonstrating their practical exploitability previously required an exceptionally complex chain of steps that pushed right up against the edge of what human researchers could practically achieve. Frontier artificial intelligence models substantially reduced that technical barrier, effectively turning a longstanding theoretical flaw into a working, weaponized exploit.
Looking ahead, the Wiz researchers warned that it is highly likely the PHP vulnerabilities will face mass-exploitation campaigns aimed at installing web-based backdoors, commonly referred to as web shells. These malicious interfaces provide attackers with a web-based administrative panel, allowing them to maintain persistent, remote control over infected sites long after the initial intrusion. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP development team, Calif, and OpenAI to measure the true scale of the problem and coordinate both patch verification and responsible disclosure timelines.
The zero-day vulnerabilities are currently being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP versions 5.4 or later. Emergency patches addressing the bugs have been incorporated into newly released versions of the language, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply embedded in the architecture of modern web applications, Wiz warned that organizations will likely struggle to patch these vulnerabilities for a prolonged period. The firm compared the current crisis to the infamous Log4Shell weakness that emerged in 2021, which exposed a widespread, maximum-severity vulnerability in Log4j, a popular Java logging framework.
As the Wiz researchers noted, a vulnerability residing in core PHP reaches far beyond any single application or isolated server. PHP operates across multi-cloud environments, enterprise hosting providers, content-delivery networks, and millions of independently managed servers worldwide. Successfully reducing exposure before the technical details became public required an unprecedented level of coordinated work across that entire global ecosystem.
Monitoring organizations are actively tracking the rollout of dependent updates. The SANS Internet Storm Center is keeping a close eye on major software platforms and Linux distributions that are rushing to ship updated PHP packages to deal with the flaws. For instance, Ubuntu has already released updated PHP packages to protect its user base. For those seeking a technical deep-dive into the vulnerabilities that details the timeline of their discovery in a unique comic-book style, security firm Calif—another technology company credited with finding the PHP flaws—has published a dedicated breakdown on its platform.
As this fast-moving security situation continues to develop across the internet, software maintainers, hosting providers, and system administrators are urged to apply the emergency PHP updates immediately to prevent full system compromise.
