Emergency PHP Security Flaws Leave Millions of Web Servers Vulnerable to Remote Control

Expect to see quite a few websites serving error pages today as system administrators scramble to implement urgent software patches. Nearly 70 percent of websites globally need to update their core software immediately to fix a pair of severe vulnerabilities that allow an authentic attacker to seize full control over affected servers. Cybersecurity experts warn that working exploits for these critical bugs already exist and that malicious actors are actively exploiting the flaws in the wild.

The vulnerabilities at issue are deeply embedded in PHP, the foundational programming language that powers a vast majority of the internet. This includes sites running on popular web publishing systems and content management platforms such as Drupal, Magento, Joomla, and WordPress. Earlier today, the PHP development team released an emergency security update to address two critical bugs that can allow an attacker to execute arbitrary code of their choosing on any vulnerable server.

Reuters reports that government websites in Europe and across other regions went offline today following the public disclosure of the PHP vulnerabilities. Meanwhile, cloud infrastructure and security provider Cloudflare stated that it has already detected active exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented specific web application firewall rules designed to shield websites from attack traffic attempting to exploit the bugs, which are capable of triggering denial of service conditions, remote code execution, and sensitive data exposure.

Artificial intelligence research organization OpenAI, which played a collaborative role in the vulnerability research and subsequent coordination efforts, noted the extraordinary gravity of the situation. Given the severity of these flaws and PHP’s massive footprint across the internet, OpenAI characterized the issue as one of the most impactful security events in recent memory.

Censys, a prominent internet attack surface management company that tracks technology used by internet hosts, revealed that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Security experts at Wiz added that every single major PHP version released over the last decade is affected by at least one of these critical vulnerabilities.

These findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software engineering, according to a detailed blog post published today by a team of researchers at Wiz, which was one of several organizations credited with discovering the flaws. The underlying structural issues had actually been present within the language for decades, but demonstrating their exploitability previously required an exceptionally complex chain of steps right at the outer edge of what human researchers could practically achieve. However, frontier artificial intelligence models substantially reduced that barrier, effectively turning a longstanding theoretical flaw into a dangerous, weaponized exploit.

The Wiz researchers warn that it is highly likely these PHP vulnerabilities will face mass-exploitation campaigns aimed at installing web-based backdoors, commonly referred to as web shells. These malicious panels provide attackers with remote browser-based control over infected websites. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem and coordinate both patch verification and responsible disclosure.

The PHP zero-day vulnerabilities are currently being tracked under their official CVE designations as CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or any subsequent version. Official patches have been released and the bugs are fully resolved in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to Wiz, PHP is so deeply intertwined with the architecture of modern web applications that many organizations will likely struggle to patch these vulnerabilities for a considerable amount of time. Industry analysts have naturally begun comparing this vulnerability pair to the infamous Log4Shell weakness that emerged in 2021, which similarly represented a widespread and severe security flaw in the popular Java logging framework Log4j.

A vulnerability residing in core PHP reaches far beyond any single application or framework, the Wiz researchers explained. PHP runs everywhere across enterprise clouds, specialized hosting providers, global content-delivery networks, and millions of independently managed web servers. Mitigating the exposure before technical details became public required an unprecedented level of coordinated work across the entire software ecosystem.

The SANS Internet Storm Center is closely monitoring the situation as major operating systems, distributions, and software platforms ship urgent updates to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its users. For a deeper technical dive into the vulnerabilities that chronicles the timeline of their discovery in a comic book style, security professionals can consult a post published by Calif, another technology company credited with discovering the bugs. As this remains a fast-moving story with widespread implications for global web infrastructure, administrators are advised to apply official patches immediately.