Expect to see quite a few websites serving error pages today as administrators scramble to secure their infrastructure. Nearly 70 percent of websites across the global internet need to update their core software immediately to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that working exploits for these flaws already exist in the wild and that malicious actors are actively targeting vulnerable systems.<\/p>\n
The critical security flaws at issue are deeply embedded in PHP, the ubiquitous programming language that powers websites running on a massive portion of the modern web. This includes popular web publishing systems, content management platforms, and e-commerce frameworks such as Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to patch two critical bugs that can allow an authenticated or unauthenticated attacker, depending on the vector, to execute arbitrary code of their choosing on any vulnerable web server.<\/p>\n
International news organizations, including Reuters, report that government websites in Europe and various other regions went offline today as agencies reacted to the sudden disclosure of the PHP vulnerabilities. Meanwhile, major cloud and security infrastructure providers have stepped in to mitigate the fallout. Cloudflare announced that it has already detected active exploitation of the flaws in the wild. To combat the threat, the company implemented specialized web application firewall rules at 3:02 am UTC to protect customer websites from incoming attack traffic. These malicious requests are designed to exploit the bugs, which can trigger a severe denial-of-service condition, remote code execution, and dangerous data exposure.<\/p>\n
OpenAI, which played a direct role in the vulnerability research and coordinated outreach efforts alongside other technology firms, issued a stark assessment of the situation. Given the extreme severity of these flaws and the remarkably widespread use of PHP across the global digital ecosystem, OpenAI stated that it considers this to be one of the most impactful and dangerous security issues in recent memory.<\/p>\n
Censys, a prominent cybersecurity firm that continuously tracks the technologies used by internet-facing hosts, published data from a recent scan identifying approximately 2.58 million internet-facing hosts and a staggering 54.9 million web properties actively running PHP. Security researchers at Wiz added further context to the scale of the crisis, noting that virtually every single version of PHP released within the last decade is affected by at least one of these vulnerabilities.<\/p>\n
The research team at Wiz, which was one of several organizations officially credited with discovering the vulnerabilities, published a comprehensive technical blog post outlining the unprecedented nature of the discovery. According to Wiz, these findings rank not only among the most severe vulnerabilities ever discovered in PHP, but arguably stand as some of the most critical flaws in software history. <\/p>\n
The underlying architectural flaws had quietly persisted in the language for decades. However, demonstrating their actual exploitability previously required an exceptionally complex chain of steps, sitting right at the absolute edge of what human security researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that technical barrier, successfully turning a longstanding, theoretical flaw into a functional and devastating exploit.<\/p>\n
Wiz researchers warn that it is now highly likely these PHP vulnerabilities will be subjected to widespread mass-exploitation. Attackers are expected to use the flaws to install web-based backdoors, commonly known as web shells. These malicious interfaces provide attackers with a discrete web-based control panel, granting them ongoing remote command over infected servers and websites. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to measure the true magnitude of the problem and to carefully coordinate patch verification and responsible disclosure.<\/p>\n
The critical PHP zero-day vulnerabilities are being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP versions 5.4 or later. To remediate the risks, administrators must update to the newly released versions, which include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.<\/p>\n
Because PHP is so deeply embedded in the architecture of countless web applications, frameworks, and server environments, Wiz warns that organizations will likely struggle to patch these vulnerabilities for a significant period of time. Industry analysts have naturally drawn comparisons between this PHP vulnerability pair and the notorious Log4Shell weakness that emerged in late 2021\u2014a similarly widespread, maximum-severity security flaw found in Log4j, a popular Java logging framework.<\/p>\n
A vulnerability residing in core PHP reaches far beyond any single application or isolated website, the Wiz researchers explained in their advisory. PHP operates across complex cloud environments, diverse hosting providers, global content-delivery networks, and millions of independently managed servers. Effectively reducing exposure and securing infrastructure before the technical details became public required an unprecedented level of coordinated work across the entire technology ecosystem.<\/p>\n
Meanwhile, the SANS Internet Storm Center is closely monitoring the situation as major software vendors and Linux distributions ship updated packages to address the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For organizations seeking a technical deep-dive into the vulnerabilities, along with a historical timeline of how the bugs were discovered presented in a comic-book style, security firm Calif\u2014another key organization credited with finding the flaws\u2014has published a dedicated breakdown on its platform. <\/p>\n
This remains a rapidly developing story, and further updates regarding patching efforts, threat intelligence, and global impact will be provided as new information becomes available.<\/p>\n","protected":false},"excerpt":{"rendered":"
Expect to see quite a few websites serving error pages today as administrators scramble to…<\/p>\n","protected":false},"author":2,"featured_media":2434,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[201,143,146,1368,144,754,200,1975,1973,145,202,820,1974],"class_list":["post-2435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-critical","tag-cybersecurity","tag-defense","tag-emergency","tag-hacking","tag-millions","tag-patches","tag-roll","tag-threaten","tag-threats","tag-vulnerabilities","tag-websites","tag-worldwide"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2435"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2435\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2434"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}