Web administrators around the world rushed to apply emergency security updates as a pair of critical vulnerabilities in PHP—the programming language powering a vast majority of the internet—began actively being exploited in the wild. Industry experts have warned that nearly 70 percent of all websites face potential compromise unless they immediately update their core software to mitigate the flaws, which grant attackers the ability to seize full control over affected servers.
The high-severity bugs, tracked under the identifiers CVE-2026-109618 and CVE-2026-109619, affect every version of PHP released over the last decade, specifically targeting web servers running PHP 5.4 or later. PHP serves as the foundational scripting language behind numerous popular web publishing platforms, content management systems, and e-commerce frameworks, including WordPress, Joomla, Drupal, and Magento. Because of this deep and pervasive integration into the global web infrastructure, the discovery has sent shockwaves through the cybersecurity community, drawing immediate comparisons to historic software crises.
Earlier today, the PHP development team released an emergency security update designed to patch the two critical bugs, which can allow an unauthorized remote attacker to execute arbitrary code of their choosing on a vulnerable web server. Security researchers have confirmed that functional exploits for these flaws already exist and are currently being leveraged in active attacks across the internet, prompting widespread concern among enterprise IT departments, hosting providers, and governmental agencies.
Reuters reported that various government websites in Europe and across other regions went offline or experienced severe service disruptions as authorities and administrators scrambled to respond to the sudden disclosure of the PHP vulnerabilities. Meanwhile, cloud security and infrastructure provider Cloudflare confirmed that it had already detected malicious exploitation attempts targeting the flaws. In response to the emerging threat, Cloudflare implemented specific web application firewall (WAF) rules at 3:02 am UTC to shield protected websites from incoming attack traffic designed to trigger the bugs. These vulnerabilities carry severe risks, including remote code execution, denial of service conditions, and unauthorized data exposure.
The severity of the situation has drawn unusual levels of attention from major technology players, including OpenAI, which participated directly in the vulnerability research and subsequent coordinated outreach. In a public statement regarding the incident, OpenAI noted that given the immense severity of these flaws alongside PHP’s ubiquitous presence across the modern web, the issue stands out as one of the most impactful security events in recent memory.
Censys, a prominent technology and internet host tracking firm, released data from a recent scanning operation revealing that approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties are currently running PHP. Given these massive figures, security analysts at Wiz—who were among the multiple organizations credited with discovering and disclosing the vulnerabilities—emphasized the unprecedented scale of the risk.
In a technical blog post published today, the Wiz research team stated that the findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably within the broader history of software development. Crucially, the researchers revealed that the underlying programming flaws had actually been present within the language for decades. However, demonstrating their exploitability previously required an exceptionally complex chain of steps that pushed against the practical limits of human research capabilities. The team noted that frontier artificial intelligence models substantially reduced this barrier, transforming a longstanding theoretical flaw into a functional, highly dangerous exploit vector.
Wiz researchers warned that the PHP vulnerabilities are likely to see widespread, mass exploitation aimed at installing web-based backdoors or malicious "web shells." These backdoors grant attackers a convenient web-based administration panel, allowing them to maintain persistent, remote control over compromised websites and servers. Prior to the public disclosure of the bugs, Wiz worked collaboratively alongside the PHP core team, Calif, and OpenAI to measure the true magnitude of the problem, verify effective patches, and coordinate responsible disclosure across the ecosystem.
The necessary security patches have been integrated into PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, security professionals stress that releasing a patch is only the first step in a long remediation process. Due to PHP’s deep entrenchment in legacy applications, custom codebases, and diverse hosting environments, organizations are expected to struggle with the patching process for an extended period. Experts have likened the current PHP crisis to the infamous Log4Shell weakness that emerged in late 2021, which exposed a pervasive and critical vulnerability within the popular Java logging framework Log4J.
As the Wiz research team pointed out, a vulnerability residing in core PHP reaches far beyond any single application or framework. PHP operates across complex cloud environments, hosting provider infrastructures, content-delivery networks, and millions of independently managed servers worldwide. Successfully reducing exposure before technical details leaked into the wild required unprecedented, coordinated remediation work across the entire technology ecosystem.
Monitoring organizations are actively tracking the rollout of updates across major operating systems and software distributions. The SANS Internet Storm Center has elevated its monitoring status and is keeping a close watch on major software platforms that are rapidly shipping updated packages to address the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its users. Additionally, technology company Calif—another organization credited with discovering the bugs—published a comic-book-styled technical deep-dive chronicling the timeline of the vulnerability discovery.
As this remains a fast-moving story with widespread implications for global web infrastructure, administrators are advised to monitor official security advisories, apply the latest PHP patches immediately, and review server logs for signs of unauthorized access or anomalous activity.
Leave a Reply