Global Websites Face Outages as Emergency Patches Issued for Critical Decade-Old PHP Vulnerabilities

Internet users across the globe are encountering unexpected error pages and service disruptions today as a massive wave of web infrastructure undergoes emergency maintenance. Approximately 70 percent of websites worldwide are rushing to update their core software following the public disclosure of a pair of critical vulnerabilities in PHP, the foundational programming language of the modern web. Security experts have confirmed that active exploits for these flaws exist and that malicious actors are already weaponizing the bugs in the wild to seize full control of vulnerable servers.

The newly disclosed vulnerabilities reside directly within PHP, a scripting language that serves as the architectural backbone for a vast portion of the internet. Content management systems and web publishing platforms that rely heavily on PHP—including widely used frameworks and software suites like WordPress, Drupal, Joomla, and Magento—are swept up in the systemic crisis. Responding to the immediate danger, the PHP development team released an emergency security update earlier today to patch two high-severity bugs that allow unauthenticated attackers to execute arbitrary code of their choosing on any compromised server.

The global impact of the disclosure was immediate. Reuters reported that government websites across Europe and other regions were forced offline as administrators scrambled to take systems offline or deploy urgent mitigations before attackers could infiltrate them. Meanwhile, cloud infrastructure and security provider Cloudflare announced that its automated defense systems had already detected malicious exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to block incoming attack traffic attempting to trigger the vulnerabilities, which present severe risks including remote code execution, denial-of-service conditions, and widespread data exposure.

Artificial intelligence developer OpenAI, which participated directly in the vulnerability research and coordinated disclosure process, emphasized the gravity of the situation. In a public statement, the company noted that given the extreme severity of the flaws and the ubiquitous nature of PHP across the global web, the discovery represents one of the most impactful security issues in recent memory.

Internet scan data from technology tracking firm Censys underscores the staggering scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million individual web properties running PHP. Security researchers at Wiz added further context, revealing that virtually every single version of PHP released over the past decade is affected by at least one of these critical vulnerabilities.

In a comprehensive technical analysis published today, researchers at Wiz—who were among the multiple organizations credited with discovering the security flaws—described the findings as ranking among the most severe vulnerabilities ever uncovered in PHP, and arguably in the history of software development. According to the Wiz research team, the underlying software flaws had quietly existed within the language for decades. However, demonstrating that the flaws could actually be exploited required an exceptionally complex chain of operational steps that previously hovered right at the absolute edge of what human security researchers could practically achieve.

The introduction of frontier artificial intelligence models substantially reduced this barrier, transforming a longstanding, theoretically difficult-to-exploit software flaw into a functional and dangerous exploit chain. The Wiz researchers warned that it is highly probable these PHP vulnerabilities will be subjected to automated mass-exploitation campaigns. Attackers are expected to leverage the flaws to install web-based backdoors, commonly known as web shells, which provide malicious actors with a convenient graphical panel to remotely command, control, and manipulate infected websites indefinitely. Prior to the public disclosure, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem and coordinate patch verification and responsible disclosure timelines.

The zero-day vulnerabilities are officially tracked in the National Vulnerability Database under the CVE designations CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP versions 5.4 and later. To remediate the issues, administrators must upgrade their systems immediately to the newly patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their active software branch.

Because PHP is so deeply integrated into the architecture of modern web development and application stacks, security analysts predict that organizations will struggle to patch these vulnerabilities for an extended period. Many are drawing direct comparisons between this unfolding PHP crisis and the infamous Log4Shell weakness that sent shockwaves through the cybersecurity industry in 2021. Log4Shell was a similarly pervasive, maximum-severity flaw affecting Log4j, a widely utilized Java logging framework.

A vulnerability residing within core PHP reaches far beyond any single application or isolated web service, the Wiz researchers explained. PHP runs everywhere across the digital ecosystem—embedded in cloud environments, managed hosting provider infrastructure, content delivery networks, and millions of independently maintained servers worldwide. Mitigating exposure and distributing patches before technical exploit details became public required an unprecedented, coordinated effort across the entire technology ecosystem.

As the situation continues to evolve, monitoring organizations are tracking the availability of downstream updates. The SANS Internet Storm Center is closely observing major software distributions and platforms as they ship updated packages to address the PHP flaws. For instance, Ubuntu has already rolled out updated PHP packages for its user base. Meanwhile, security firm Calif—another technology organization credited with discovering the vulnerabilities—published a detailed technical breakdown of the discovery timeline presented in a unique comic book format for researchers and administrators seeking a deep dive into how the bugs were found.

Security teams and system administrators worldwide remain on high alert as remediation efforts continue, with further updates expected as more organizations report on patching progress and ongoing mitigation challenges.