Critical PHP Vulnerabilities Trigger Global Emergency Patches and Active Exploitation

Expect to see quite a few websites serving error pages and going offline today, as an urgent global scramble unfolds across the internet. Nearly 70 percent of websites worldwide are facing an immediate necessity to update their core software to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Cybersecurity experts have confirmed that working exploits for these flaws are already in existence, and that these critical bugs are actively being exploited in the wild, prompting swift emergency responses from governments, infrastructure providers, and software maintainers alike.

The flaws at issue are deeply embedded in PHP, the ubiquitous programming language that powers a massive share of the internet. Websites running on a vast number of web publishing systems, content management frameworks, and e-commerce platforms—including Drupal, Magento, Joomla, and WordPress—rely fundamentally on PHP to process server-side logic. In response to the crisis, the PHP development team released an emergency security update earlier today to patch two critical bugs that can allow an authenticated or unauthenticated attacker, depending on the vector, to execute arbitrary code of their choosing on a vulnerable web server.

Reuters reports that government websites in Europe and various other regions went offline today as a precautionary measure immediately following the public disclosure of the PHP vulnerabilities. Meanwhile, major cloud and security infrastructure provider Cloudflare stated that it had already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall (WAF) rules designed to protect customer websites from incoming attack traffic seeking to exploit the bugs. According to technical assessments, these vulnerabilities could potentially cause severe operational disruptions, including denial of service conditions, remote code execution, and unauthorized data exposure.

OpenAI, which played a direct role in the vulnerability research and coordinated disclosure process, emphasized the gravity of the situation. In a public statement regarding the discovery, OpenAI noted that given the extreme severity of these flaws and PHP’s overwhelmingly widespread use across the global web, they consider this to be one of the most impactful security issues in recent memory.

Censys, a prominent technology and threat-tracking company that monitors internet-facing hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP. The sheer scale of this footprint underscores the monumental challenge facing system administrators, hosting providers, and enterprise security teams as they race to apply patches before threat actors can weaponize the flaws at scale.

Security researchers at Wiz further elaborated on the universal scope of the problem, noting that virtually every single PHP version released over the last decade is affected by at least one of these critical vulnerabilities.

These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history, according to a technical blog post published today by a team of researchers at Wiz, who were among the several specialized organizations credited with discovering the vulnerabilities. The underlying architectural flaws had quietly persisted within the language for decades, but demonstrating their practical exploitability previously required an exceptionally complex chain of steps, hovering right at the absolute edge of what human researchers could practically achieve. However, frontier artificial intelligence models substantially reduced that historical barrier, turning a longstanding, theoretical flaw into a working, dangerous exploit.

The Wiz researchers warn that it is highly likely these PHP vulnerabilities will face widespread mass exploitation by malicious actors looking to install web-based backdoors, commonly referred to as web shells. These malicious interfaces provide attackers with a discrete web-based control panel that allows them to maintain persistent, remote control over compromised sites long after the initial breach. Prior to the public disclosure of the PHP bugs, Wiz worked closely alongside the PHP core development team, technology firm Calif, and OpenAI to measure the true breadth of the problem, verify patches, and coordinate a responsible disclosure timeline.

The PHP zero-day vulnerabilities are currently being tracked under their official Common Vulnerabilities and Exposures identifiers: CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP version 5.4 or later. To remediate the issues, administrators must upgrade to the newly released patched versions, which include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to Wiz, PHP is so deeply embedded in the modern web application stack that organizations will likely struggle to patch these vulnerabilities for a prolonged period. Security analysts have drawn direct comparisons between this critical PHP vulnerability pair and the infamous Log4Shell weakness that emerged in 2021—a similarly pervasive, severe software flaw found in Log4j, a popular Java logging framework that kept security teams occupied with remediation efforts for years.

A vulnerability in core PHP reaches far beyond a single application or isolated web service, the Wiz researchers explained in their analysis. PHP runs across multi-cloud environments, independent hosting providers, massive content-delivery networks, and tens of millions of independently managed servers. Effectively reducing overall exposure before technical details became public required an unprecedented level of coordinated remediation work across that entire sprawling ecosystem.

The SANS Internet Storm Center is closely monitoring the situation as major software platforms and Linux distributions ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its supported operating system releases. For readers seeking a deeper technical dive into the vulnerabilities alongside a timeline of how the bugs were discovered, technology firm Calif—another key organization credited with finding the flaws—has published a detailed technical breakdown styled in a comic book format on their website.

This remains a rapidly developing story, and further updates from security vendors, software maintainers, and infrastructure operators are expected as the global technology community works to secure the backbone of the web.