Expect to see quite a few websites serving error pages and going offline today, as an emergency security update reveals that nearly 70 percent of all web properties need to update their core software immediately. A pair of critical vulnerabilities discovered in PHP—the foundational programming language driving a massive share of the internet—allows an unauthenticated attacker to seize full control over affected servers, execute arbitrary code, trigger denial-of-service conditions, and expose sensitive data. Cybersecurity experts and threat intelligence groups have confirmed that working exploits for these flaws already exist, and that malicious actors are actively weaponizing the bugs in the wild.
The vulnerabilities reside deep within PHP, the server-side scripting language that serves as the backbone for countless web publishing platforms, content management systems, and enterprise frameworks, including WordPress, Drupal, Magento, and Joomla. In response to the crisis, the PHP development team released an emergency security update earlier today, urging system administrators and hosting providers to patch their systems without delay. However, because the programming language is so deeply woven into the architecture of modern web infrastructure, applying the necessary updates across the global digital landscape is expected to be a monumental and prolonged challenge.
Government websites across Europe and various other regions went offline or experienced severe disruptions shortly after the vulnerabilities were publicly disclosed, prompting warnings from regional cybersecurity agencies. Major internet infrastructure and security providers have mobilized rapidly to mitigate the fallout. Cloudflare announced that its systems detected active exploitation attempts targeting the flaws. In response, the cloud security firm implemented web application firewall rules at 3:02 am UTC to intercept malicious attack traffic designed to trigger remote code execution, cause server crashes, or extract underlying database information.
Artificial intelligence pioneer OpenAI, which participated directly in the vulnerability research, coordination, and disclosure process alongside security vendors, issued a stark assessment of the situation. Given the severity of these flaws and the ubiquitous nature of PHP across global web infrastructure, OpenAI stated that it considers this development to be one of the most impactful and dangerous security issues witnessed in recent memory.
The scale of the potential attack surface is staggering. According to Censys, a digital risk and internet-scanning platform that tracks technology deployed across global hosts, a recent scan identified approximately 2.58 million internet-facing hosts and an estimated 54.9 million individual web properties running PHP. Security researchers at Wiz added further context to the alarming scope of the crisis, noting that every single release of PHP introduced over the past decade is affected by at least one of these critical vulnerabilities.
The discoveries rank among the most severe security flaws ever uncovered in PHP, and arguably in the broader history of software engineering, according to a technical analysis published today by researchers at Wiz, who were part of the multi-organizational team credited with finding the bugs. The underlying architectural flaws had quietly persisted within the language for decades. However, demonstrating their practical exploitability previously required an exceptionally complex chain of operational steps—pushing right against the boundaries of what human security researchers could practically achieve. According to Wiz, frontier artificial intelligence models substantially reduced that technical barrier, effectively transforming a longstanding theoretical weakness into a reliable, weaponized exploit.
Wiz researchers warn that the PHP vulnerabilities will likely face automated, mass-exploitation campaigns aimed at installing web-based backdoors or malicious "web shells." These web-based control panels give attackers persistent, remote administrative access, allowing them to quietly control infected servers, pivot into internal corporate networks, and deploy further payloads. Prior to the public disclosure, Wiz collaborated closely with the PHP security team, technology firm Calif, and OpenAI to accurately measure the systemic risks, verify the effectiveness of forthcoming patches, and coordinate a responsible disclosure timeline.
The zero-day vulnerabilities are being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP versions 5.4 and later. The PHP team has addressed the flaws in newly released versions, specifically PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Upgrading to these patched versions is the only definitive way to close the security gap and prevent total server compromise.
Industry analysts have drawn direct comparisons between this unfolding PHP crisis and the infamous Log4Shell vulnerability that surfaced in late 2021, which exposed a pervasive, critical weakness in the Log4j Java logging framework. Because PHP is foundational to millions of independently managed servers, cloud environments, hosting platforms, and content-delivery networks, organizations are expected to struggle with remediation efforts for weeks or even months to come. A vulnerability residing in core PHP reaches far beyond any single application or CMS, creating widespread ecosystem-wide exposure that required extensive, synchronized patching efforts across the entire web hosting industry before technical details were made public.
Security monitoring organizations, including the SANS Internet Storm Center, are closely tracking major software distributors, Linux distributions, and hosting ecosystems as they rush to ship updated PHP packages. For instance, Ubuntu has already released updated system packages to protect its user base. Meanwhile, technology firm Calif—another organization credited with discovering the vulnerabilities—published a comic-book-style technical deep-dive and timeline detailing the discovery process.
As this fast-moving security event continues to unfold across the internet, system administrators, web hosting providers, and enterprise security teams are racing against active attackers to secure their infrastructure and apply the emergency patches before unauthorized actors can establish permanent footholds.
Leave a Reply