Global Web Infrastructure Faces Severe Disruption After Emergency PHP Zero-Day Patches Release

Expect to see quite a few websites serving error pages and going offline today, as nearly 70 percent of websites face the urgent task of updating their core software to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Cybersecurity experts say that working exploits for the flaws already exist in the wild, and these critical bugs are actively being leveraged by malicious actors.

The flaws at issue are deeply embedded in PHP, the foundational programming language that powers a massive share of the internet, including sites running on popular web publishing systems and content management platforms such as Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to patch two critical bugs capable of allowing an attacker to execute arbitrary code of their choosing on any vulnerable server.

Reuters reports that government websites in Europe and various other regions went offline today immediately following the public disclosure of the PHP vulnerabilities. Meanwhile, cloud infrastructure and security provider Cloudflare reported that it has already detected active exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to shield websites from attack traffic attempting to exploit the bugs, which could otherwise trigger denial-of-service conditions, remote code execution, and dangerous data exposure.

OpenAI, which played a direct role in the vulnerability research and coordinated outreach efforts, stated that given the sheer severity of these flaws and PHP’s ubiquitous presence across the modern web, it considers this security issue to be one of the most impactful in recent memory.

Censys, a specialized internet host intelligence and technology tracking firm, noted that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP worldwide, highlighting the staggering scale of the potential attack surface.

Security researchers at Wiz reported that virtually every PHP version released over the past decade is affected by at least one of these critical vulnerabilities.

In a detailed technical blog post published today, a team of researchers at Wiz—who were among the multiple organizations credited with discovering the vulnerabilities—emphasized the unprecedented nature of the find. According to the researchers, these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software development. The underlying flaws had actually been lurking in the codebase for decades, but demonstrating their exploitability previously required an exceptionally complex chain of steps right at the edge of what human researchers could practically achieve. However, frontier artificial intelligence models substantially reduced that historical barrier, effectively turning a longstanding, theoretical flaw into a working, dangerous exploit.

The Wiz researchers warn that it is highly likely these PHP vulnerabilities will face widespread, automated mass-exploitation campaigns aimed at installing web-based backdoors or web shells. These malicious panels grant attackers persistent, remote control over infected web servers. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem, verify patches, and coordinate a safe disclosure timeline.

The zero-day vulnerabilities are officially tracked by their assigned Common Vulnerabilities and Exposures numbers as CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or later versions. Official patches have been issued and are now available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to Wiz, PHP is so deeply interwoven into the architecture of modern web applications that organizations will likely struggle to patch these vulnerabilities for a significant period of time. Experts are already drawing comparisons between this PHP vulnerability pair and the infamous Log4Shell weakness that emerged in 2021—a similarly pervasive and severe security flaw found in Log4j, a popular Java logging framework.

A vulnerability residing in core PHP reaches far beyond a single application or website, the Wiz researchers explained. PHP runs across multi-cloud environments, web hosting providers, content-delivery networks, and millions of independently managed servers worldwide. Minimizing exposure before technical details leaked into the wild required unprecedented, coordinated work across that entire global technology ecosystem.

Meanwhile, the SANS Internet Storm Center is closely monitoring major software platforms and Linux distributions as they rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For administrators and security professionals seeking a technical deep-dive into the vulnerabilities alongside a timeline of how the bugs were discovered, technology company Calif—another organization credited with finding the flaws—has published a comic-book-style breakdown on its website.