Global Web Infrastructure Jolted by Critical PHP Zero-Day Flaws as Mass Exploitation Begins

Expect to see quite a few websites serving error pages and going offline today, as an emergency security crisis hits the global digital infrastructure. Nearly 70 percent of websites across the internet are facing an urgent need to update their core software to patch a pair of critical vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that working exploits for these dangerous flaws already exist, and intelligence indicates that the bugs are actively being exploited in the wild.

The vulnerabilities at the center of this unfolding crisis reside in PHP, the widely used server-side programming language that powers an enormous share of the modern web. PHP serves as the foundational engine for countless sites running on major web publishing systems, content management platforms, and e-commerce frameworks, including WordPress, Joomla, Drupal, and Magento. In response to the discovery, the PHP development team released an emergency security update earlier today to fix two critical bugs capable of allowing an arbitrary attacker to execute code of their choosing on any vulnerable web server.

Government websites in Europe and across various other international jurisdictions have already gone offline following the public disclosure of the PHP vulnerabilities. Meanwhile, major infrastructure and security firms are scrambling to defend their networks. Cloudflare announced that it has already detected active exploitation attempts targeting the flaws. In response to the threat, the company implemented specialized web application firewall rules at 3:02 am UTC to protect client websites from incoming malicious traffic designed to exploit the bugs. According to technical assessments, these vulnerabilities can lead to severe consequences, including remote code execution, denial of service conditions, and widespread data exposure.

OpenAI, which played an instrumental role alongside researchers in vulnerability analysis and coordinated disclosure efforts, issued a stark assessment of the situation. Given the extreme severity of these flaws and the ubiquitous nature of PHP across the global internet, OpenAI stated that it considers this development to be one of the most impactful cybersecurity issues witnessed in recent memory.

Data compiled by Censys, a technology platform that tracks internet-facing infrastructure and hosts, underscores the massive scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Security researchers at Wiz added further gravity to the situation by noting that virtually every single version of PHP released over the past decade is affected by at least one of these critical vulnerabilities.

In a comprehensive technical blog post published today, a team of researchers at Wiz—who were among the multiple organizations credited with discovering the flaws—ranked the findings among the most severe vulnerabilities ever uncovered in PHP, and arguably in the history of software development. The researchers noted that the underlying architectural flaws had actually been present within the language for decades. However, demonstrating their practical exploitability previously required navigating an exceptionally complex chain of steps, pushing right against the outer boundaries of what human security researchers could practically achieve.

The introduction of frontier artificial intelligence models substantially reduced that barrier, turning a longstanding, theoretical software flaw into a functional and repeatable exploit chain. The Wiz researchers warned that it is highly probable these PHP vulnerabilities will face automated, mass-exploitation campaigns designed to install web-based backdoors or web shells. These malicious tools provide attackers with an administrative web panel that allows them to maintain persistent, remote control over infected web properties. Before making the PHP bugs public, Wiz coordinated closely with the PHP development team, Calif, and OpenAI to measure the true breadth of the problem, verify effective patches, and manage a responsible disclosure timeline.

The zero-day vulnerabilities in PHP are currently being tracked under their official CVE identifiers, designated as CVE-2026-109618 and CVE-2026-109619. These critical security gaps affect all web servers operating on PHP 5.4 or any subsequent version. Official patches have been rolled out and are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Security analysts at Wiz emphasize that because PHP is so deeply and invisibly embedded into the architecture of countless web applications and hosting environments, organizations will likely struggle with remediation and patching efforts for a significant period. Experts have begun comparing this ongoing PHP security crisis to the infamous Log4Shell weakness that emerged in late 2021, which presented a similarly pervasive and severe threat involving Log4j, a popular Java logging framework.

A vulnerability that originates in core PHP reaches far beyond the boundaries of any single application or developer error, according to the Wiz research team. PHP operates seamlessly across cloud environments, dedicated hosting providers, content-delivery networks, and millions of independently administered servers worldwide. Mitigating total exposure before the technical details leaked required an unprecedented, coordinated effort across the entire technology ecosystem.

Meanwhile, monitoring bodies such as the SANS Internet Storm Center are closely watching major software platforms and Linux distributions as they rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. Organizations seeking a technical deep-dive into how these bugs were uncovered—narrated through a unique timeline presented in a comic book style—can review documentation published by Calif, another technology firm credited with discovering the vulnerabilities.

As this remains a rapidly developing global security situation, infrastructure providers, system administrators, and web hosting companies continue to apply emergency patches and monitor network traffic for signs of unauthorized access.