By Laily UPN 
Websites across the globe are displaying error pages and going offline as administrators scramble to apply emergency patches for a pair of critical vulnerabilities affecting PHP, the programming language that serves as the backbone for a massive portion of the internet. Security experts estimate that nearly 70 percent of all websites require immediate core software updates to fix the flaws, which allow attackers to seize complete control over affected servers, execute arbitrary code, and exfiltrate sensitive data.
The security crisis unfolded rapidly after PHP released an emergency security update earlier in the day to address the two critical bugs. The vulnerabilities reside directly within PHP, impacting platforms running on popular content management systems and web publishing frameworks such as WordPress, Drupal, Magento, and Joomla. Government websites in Europe and various other regions went offline almost immediately following the public disclosure as administrators took systems offline to mitigate the risk of compromise.
Cloudflare reported that it detected active exploitation of the flaws in the wild shortly after disclosure. To protect its customer base, Cloudflare implemented specialized web application firewall rules to intercept attack traffic designed to trigger the bugs, which can cause severe operational disruptions, including denial of service conditions, remote code execution, and data exposure.
The vulnerabilities, tracked under the official identifiers CVE-2026-109618 and CVE-2026-109619, affect virtually every web server running PHP 5.4 or later. Security researchers at Wiz noted that every single version of PHP released over the past decade is impacted by at least one of these two vulnerabilities. According to telemetry from Censys, a company that monitors internet-facing technology, recent scans identified approximately 2.58 million internet-facing hosts and 54.9 million web properties utilizing PHP, illustrating the staggering scale of the potential attack surface.
The discovery of the zero-day bugs involved a collaborative effort among several prominent technology organizations, including OpenAI, Wiz, and Calif, working alongside the core PHP development team. In a detailed blog post, researchers at Wiz described the findings as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software development.
The Wiz research team revealed that the underlying architectural flaws had been present within the language for decades. However, demonstrating that the flaws could be practically exploited required an exceptionally complex chain of operational steps that sat at the very edge of what human researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that technical barrier, effectively transforming a longstanding theoretical flaw into a working, high-impact exploit.
OpenAI, which played a direct role in the vulnerability research and coordinated disclosure process, emphasized the gravity of the situation. Given the extreme severity of the flaws and the ubiquitous nature of PHP across modern web infrastructure, OpenAI officials stated that they consider this security event to be one of the most impactful issues witnessed in recent memory.
Prior to the public disclosure of the vulnerabilities, Wiz worked alongside the PHP team, Calif, and OpenAI to measure the true magnitude of the problem, verify patches, and coordinate a responsible disclosure timeline. Despite these proactive measures, experts warn that the transition period will be perilous. Wiz researchers stated that it is highly probable the PHP vulnerabilities will face automated, mass exploitation campaigns aimed at installing web-based backdoors, commonly known as web shells. These malicious panels provide attackers with persistent, remote control over infected web servers, allowing them to pivot deeper into enterprise networks or launch subsequent attacks.
Because PHP is so deeply embedded into the architecture of modern web applications, security professionals predict that organizations will struggle to patch their environments for an extended period. Many analysts are comparing the severity and widespread nature of this PHP security crisis to the infamous Log4Shell vulnerability that emerged in late 2021, which crippled Java-based logging frameworks globally and kept incident response teams occupied for months.
A vulnerability residing in core PHP reaches far beyond a single application or hosting provider. PHP operates seamlessly across multi-cloud environments, content-delivery networks, specialized hosting platforms, and millions of independently managed servers worldwide. Reducing exposure before the technical details became public required an unprecedented level of coordinated remediation across the entire web ecosystem.
Security organizations and incident response centers are closely monitoring the rollout of official patches. The vulnerabilities have been resolved in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Major operating system vendors and software platforms are rapidly releasing updated packages to help administrators secure their infrastructure, with Ubuntu among the first to distribute updated PHP packages to the public. Meanwhile, the SANS Internet Storm Center is maintaining heightened alert levels and tracking major software updates as they address the critical PHP flaws. For a more granular technical deep-dive into the discovery process, researchers and system administrators have pointed to an illustrated timeline published by Calif, another technology firm credited with uncovering the bugs.
Layla Zulfa 
Raul Delapena Setiawan 
Asep Darmawan