Web administrators around the globe are scrambling to apply emergency security updates today as a staggering percentage of internet-facing servers find themselves exposed to a severe security threat. Nearly 70 percent of websites depend on core software that must be updated immediately to patch a pair of high-severity vulnerabilities. According to cybersecurity experts, these flaws grant malicious actors the ability to seize full control over affected servers. Working exploits for the bugs are already publicly available, and security analysts confirm that these critical security holes are actively being exploited in the wild.
The vulnerabilities reside in PHP, the ubiquitous server-side programming language that serves as the backbone for a massive share of the modern web. Countless websites, content management systems, and publishing platforms—including major household names like WordPress, Drupal, Magento, and Joomla—rely heavily on PHP to function. In response to the crisis, the PHP development team released an emergency security update earlier today to resolve two critical bugs. These vulnerabilities can allow an unauthenticated attacker to execute arbitrary code of their choosing directly on a vulnerable web server, effectively opening the door to total system compromise.
The impact of the disclosure was felt almost immediately across the digital landscape. Reuters reported that government websites in Europe and various other regions went offline as administrators raced to take systems down or apply patches following the public disclosure of the PHP vulnerabilities. Meanwhile, infrastructure and security giant Cloudflare reported that it had already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall (WAF) rules designed to protect customer websites from incoming attack traffic seeking to exploit the bugs. According to telemetry from the firm, these vulnerabilities could easily trigger catastrophic outcomes, including denial of service conditions, remote code execution, and severe data exposure.
Artificial intelligence pioneer OpenAI played a direct role in the vulnerability research and coordinated disclosure process. In a public statement regarding the incident, OpenAI noted that given the extreme severity of the flaws coupled with the extraordinarily widespread adoption of PHP, this situation represents one of the most impactful security issues witnessed in recent memory.
Data from Internet scanning and host-tracking firm Censys underscores the massive scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and an astonishing 54.9 million individual web properties running PHP. Security researchers at Wiz added further gravity to the situation, noting that virtually every single version of PHP released over the last decade is affected by at least one of these vulnerabilities.
In a detailed blog post published today, a team of researchers at Wiz—who were credited alongside other organizations with discovering the vulnerabilities—did not mince words regarding the historical significance of the bugs. The researchers stated that these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software development. According to the team, the underlying flaws had actually been present within the language’s core codebase for decades. However, demonstrating their exploitability previously required an exceptionally complex chain of operational steps that hovered right at the absolute edge of what human researchers could practically achieve. The introduction of frontier AI models substantially reduced that technical barrier, effectively transforming a longstanding, theoretical flaw into a dangerous, functional exploit.
The Wiz researchers warn that the PHP vulnerabilities are prime candidates for mass exploitation. Attackers are expected to leverage the bugs to install web-based backdoors or malicious "web shells," which provide unauthorized operators with a convenient web-based administrative panel that grants persistent, remote control over infected sites. Before the PHP bugs were publicly disclosed, Wiz worked closely in coordination with the PHP development team, security firm Calif, and OpenAI to accurately measure the scope of the problem, verify patches, and prepare a coordinated disclosure strategy.
The zero-day vulnerabilities are being tracked officially under Common Vulnerabilities and Exposures identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP versions 5.4 or later. The PHP development team has officially addressed and resolved these bugs in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. System administrators and hosting providers running any unsupported or older iterations of the language are at immediate risk if they have not already applied the necessary patches or compensating controls.
Because PHP is so deeply and invisibly embedded into the architecture of countless web applications, frameworks, and hosting environments, security experts predict that organizations will struggle to patch these vulnerabilities for a prolonged period. Analysts have drawn direct comparisons between this unfolding PHP crisis and the infamous Log4Shell weakness that sent shockwaves through the cybersecurity industry in 2021. Log4Shell involved a ubiquitous and severe vulnerability in Log4j, a wildly popular Java logging framework, proving that bugs residing deep within foundational software components pose uniquely intractable challenges.
As the Wiz research team pointed out, a vulnerability in core PHP reaches far beyond the boundaries of any single application or website. PHP operates seamlessly across multi-cloud environments, independent hosting providers, massive content-delivery networks, and millions of independently managed enterprise and personal servers. Mitigating exposure and pushing fixes before technical details leaked into the wild required unprecedented, synchronized collaboration across the entire global technology ecosystem.
Meanwhile, monitoring bodies like the SANS Internet Storm Center are keeping a watchful eye on major software platforms, Linux distributions, and container registries as they rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu swiftly released updated PHP packages to shield its user base from impending attacks. For organizations seeking a technical deep-dive into the vulnerabilities—complete with a detailed historical timeline of how the bugs were discovered presented in a comic-book style format—security firm Calif has published a dedicated analysis on its website.
With millions of servers potentially at risk and active exploitation already underway, the digital security community remains on high alert. As this is a fast-moving, developing story across the global web infrastructure, further updates, telemetry data, and patch advisories will be monitored closely as administrators race to secure their environments.
