Emergency Patches Released for Critical PHP Vulnerabilities Being Exploited in the Wild

Expect to see quite a few websites serving error pages today: nearly 70 percent of websites need to update their core software to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that there are working exploits for the flaws, and that these critical security bugs are already actively being exploited in the wild.

The vulnerabilities at issue are present in PHP, the foundational programming language that powers a vast ecosystem of websites running on a large number of popular web publishing systems, content management platforms, and e-commerce frameworks, including Drupal, Magento, Joomla, and WordPress. Earlier today, the PHP development team released an emergency security update to address two critical bugs that can allow an unauthenticated attacker to execute arbitrary code of their choosing on a vulnerable server.

Reuters reports that government websites in Europe and various other regions went offline today immediately after the PHP vulnerabilities were publicly disclosed. Meanwhile, cloud infrastructure and security firm Cloudflare stated that it has already detected active exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to protect customer websites from incoming attack traffic seeking to exploit the bugs, which can trigger severe conditions including denial of service, remote code execution, and unauthorized data exposure.

OpenAI, which played a direct role in the vulnerability research and coordinated disclosure outreach, noted the extraordinary gravity of the situation. Given the severity of these flaws and PHP’s remarkably widespread use across the global internet, OpenAI officials stated that they consider this to be one of the most impactful software security issues in recent memory.

Censys, a specialized cybersecurity firm that tracks the technologies and infrastructure utilized by internet-facing hosts, reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP.

Security researchers at Wiz added that every single major release version of PHP introduced over the last decade is affected by at least one of these vulnerabilities. Wiz is an advertiser on this blog, but its research team was among several prominent cybersecurity organizations credited with discovering the underlying flaws.

These findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software engineering, according to a technical blog post published today by the research team at Wiz. The underlying architectural flaws had quietly resided within the language for decades, but successfully demonstrating their exploitability previously required an exceptionally complex chain of steps, sitting right at the absolute edge of what human security researchers could practically achieve. However, frontier artificial intelligence models substantially reduced that historical barrier, effectively turning a longstanding theoretical flaw into a working, weaponized exploit.

The Wiz researchers warn that it is highly likely the newly disclosed PHP vulnerabilities will face widespread, automated mass-exploitation. Attackers are expected to leverage the bugs to install persistent web-based backdoors or web shells, which provide malicious actors with a convenient web-based administrative panel that allows them to remotely control infected web servers at will. Prior to the PHP bugs being officially disclosed to the public, Wiz worked closely with the core PHP development team, security firm Calif, and OpenAI to measure the true scale of the problem and coordinate patch verification and responsible disclosure.

The PHP zero-day vulnerabilities are currently being tracked under their official Common Vulnerabilities and Exposures (CVE) identification numbers, designated as CVE-2026-109618 and CVE-2026-109619. These critical security flaws affect all web servers running PHP 5.4 or later. Official software patches have been issued and are now available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to Wiz, PHP is so deeply and invisibly embedded in countless web applications, frameworks, and server-side scripts that organizations globally are likely to struggle with patching these vulnerabilities for a significant period of time. Industry experts have begun drawing parallels between this vulnerability pair and the notorious Log4Shell weakness that emerged in late 2021, which similarly introduced a widespread, severe-as-it-gets security flaw into Log4j, a popular Java logging framework.

A vulnerability residing within core PHP reaches far beyond any single application or isolated website, the Wiz researchers explained in their technical advisory. PHP runs across complex cloud environments, commercial hosting providers, content-delivery networks, and millions of independently managed enterprise and personal servers. Reducing global exposure before the sensitive technical details inevitably became public required unprecedented, coordinated work across that entire software ecosystem.

The SANS Internet Storm Center is closely monitoring major software platforms, Linux distributions, and operating system maintainers as they rush to ship updated packages to deal with these PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For administrators looking for a detailed technical deep-dive on these vulnerabilities that outlines the full timeline of their discovery in a unique comic-book style format, Calif—another technology company credited with discovering the PHP flaws—has published a dedicated breakdown on its website.

As this remains a rapidly developing, fast-moving cybersecurity story, further updates, telemetry data, and patch advisories will be noted here as additional information becomes available from security vendors and infrastructure providers.