Global Web Infrastructure Faces Severe Disruption as Emergency PHP Flaws Spark Mass Exploitation

Internet users and system administrators worldwide are facing widespread disruptions today as approximately 70 percent of websites are forced to rush emergency software updates to patch a pair of critical vulnerabilities. These severe security flaws allow an attacker to seize full control over affected servers, leading security experts to warn that active exploits are already being deployed in the wild.

The vulnerabilities reside in PHP, the foundational programming language that powers an enormous share of the modern web. PHP serves as the backend engine for countless websites, applications, and major web publishing frameworks, including WordPress, Drupal, Magento, and Joomla. In response to the discovery, the PHP development team released an emergency security update earlier today to resolve two critical bugs that enable malicious actors to execute arbitrary code of their choosing on vulnerable servers.

The impact of the disclosure was felt almost immediately across the global digital infrastructure. Reuters reported that government websites in Europe and various other regions went offline as agencies scrambled to mitigate the threat after the PHP vulnerabilities were made public. Meanwhile, major security and infrastructure providers have observed active malicious traffic targeting the flaws. Cloudflare stated that it detected exploitation attempts shortly after disclosure and implemented web application firewall rules at 3:02 am UTC to protect customer websites from incoming attack traffic. According to Cloudflare, these bugs could potentially trigger severe conditions, including denial of service attacks, remote code execution, and unauthorized data exposure.

The scale of the crisis is vast, reflecting the ubiquity of PHP in the global technology ecosystem. Data from Censys, an organization that tracks internet-facing technologies, indicates that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP. Security researchers at Wiz added that every single version of PHP released over the past decade is affected by at least one of these critical vulnerabilities.

Describing the gravity of the situation, a team of researchers at Wiz—one of several organizations credited with discovering the flaws alongside OpenAI and Calif—stated that the issue ranks among the most severe vulnerabilities ever uncovered in PHP and potentially in software history. According to the Wiz research team, the underlying architectural flaws had existed within the language for decades, but demonstrating their exploitability previously required an exceptionally complex chain of steps that pushed against the practical limits of human research capabilities. However, the involvement of frontier artificial intelligence models substantially lowered that barrier, effectively transforming a longstanding theoretical flaw into a functional, weaponized exploit.

OpenAI, which assisted extensively in the vulnerability research and coordinated disclosure process, emphasized the extraordinary nature of the threat. Given the severity of the flaws and PHP’s exceptionally widespread adoption across the internet, OpenAI characterized the situation as one of the most impactful security issues in recent memory. Wiz researchers similarly noted that the vulnerabilities are likely to be leveraged heavily in automated mass-exploitation campaigns aimed at installing web-based backdoors or web shells, which provide attackers with persistent, remote control panels over compromised web servers. Prior to public disclosure, Wiz collaborated with the PHP development team, Calif, and OpenAI to measure the scope of the problem, verify patches, and coordinate a synchronized rollout.

The zero-day vulnerabilities are officially tracked under Common Vulnerabilities and Exposures identifiers CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP version 5.4 or later. To remediate the flaws, administrators must upgrade to the newly released patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

Industry analysts predict that remediation will be a protracted and difficult process. Because PHP is deeply embedded across diverse software stacks, hosting environments, and application layers, organizations are expected to struggle with patching over an extended period. Security experts have drawn comparisons between this unfolding crisis and the infamous Log4Shell vulnerability of 2021, which similarly affected a ubiquitous foundational component of the Java ecosystem.

As the Wiz research team highlighted, a vulnerability in core PHP extends far beyond any single application or framework. The language operates across cloud environments, major hosting providers, content-delivery networks, and millions of independently managed servers worldwide, making ecosystem-wide coordination essential to reducing overall exposure before technical exploit details became public knowledge.

Monitoring bodies and technical organizations continue to track developments closely as software vendors roll out necessary updates. The SANS Internet Storm Center has raised its alert posture and is actively monitoring major software platforms as they integrate the updated PHP packages into their distributions. For example, Ubuntu has already released updated PHP packages for its operating system users. Organizations seeking a technical deep-dive into the discovery timeline of the vulnerabilities can also consult documentation provided by Calif, a technology company that played a key role in identifying the bugs.

As this remains a fast-moving security situation, system administrators and webmasters are strongly encouraged to apply the official PHP patches immediately to protect their infrastructure from ongoing exploitation attempts.