Expect to see quite a few websites serving error pages and going offline today, as internet infrastructure operators and security teams scramble to respond to a massive global cyber threat. Nearly 70 percent of all websites on the internet need to update their core software immediately to fix a pair of severe vulnerabilities that allow an attacker to seize full control over affected servers. Security experts have confirmed that working exploits for these flaws already exist, and that these critical bugs are actively being exploited in the wild by malicious actors.
The dangerous flaws at issue are present in PHP, the foundational programming language that powers a vast majority of the internet. This includes sites running on major content management systems and web publishing frameworks such as Drupal, Magento, Joomla, and WordPress. In response to the crisis, the PHP development team released an emergency security update earlier today to patch two critical bugs. These vulnerabilities can allow an unauthenticated attacker to execute arbitrary code of their choosing on any vulnerable server running the software.
The impact of the disclosure was felt almost immediately across the globe. Reuters reports that various government websites in Europe and other regions went offline today after the PHP vulnerabilities were publicly disclosed. Meanwhile, cloud infrastructure and security firm Cloudflare stated that it has already detected real-world exploitation of the flaws. At 3:02 am UTC, Cloudflare implemented emergency web application firewall rules to protect customer websites from incoming attack traffic seeking to exploit the bugs. According to technical assessments, these vulnerabilities could cause denial of service conditions, remote code execution, and severe data exposure if left unmitigated.
Artificial intelligence research firm OpenAI, which was directly involved in the vulnerability research and coordinated outreach process, noted the historic scale of the issue. OpenAI stated that given the severity of these flaws and PHP’s exceptionally widespread use, they consider this to be one of the most impactful security issues in recent memory.
Internet intelligence and attack surface management company Censys reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP. Because PHP serves as the invisible backbone for a staggering portion of the global web, the exposure radius is nearly unprecedented. Security experts at Wiz added that every single major version of PHP released in the last decade is affected by at least one of these critical vulnerabilities.
In a detailed technical blog post published today, a team of researchers at Wiz—who were among several organizations credited with discovering the vulnerabilities—described the historic nature of the find. They noted that these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in software history. The underlying architectural flaws had actually been present in the language code for decades, but demonstrating their exploitability previously required an exceptionally complex chain of steps right at the edge of what human researchers could practically achieve. However, frontier AI models substantially reduced that cognitive and technical barrier, turning a longstanding theoretical flaw into a weaponized exploit.
The Wiz researchers warned that it is highly likely these PHP vulnerabilities will be subjected to mass automated exploitation by cybercriminals aiming to install web-based backdoors or web shells. These malicious scripts provide attackers with a discrete web-based administrative panel that allows them to maintain remote control over infected sites indefinitely. Prior to the public disclosure of the PHP bugs, Wiz worked closely with the PHP security team, Calif, and OpenAI to measure the scale of the problem and carefully coordinate patch verification and responsible disclosure.
The PHP zero-day vulnerabilities are currently being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or any subsequent version. The core development team has issued emergency patches to resolve the bugs, which are now fully fixed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Wiz cautioned that because PHP is so deeply embedded in the modern web application ecosystem, organizations will likely struggle to patch these vulnerabilities for a prolonged period. Security analysts have drawn direct comparisons between this PHP vulnerability pair and the notorious Log4Shell weakness that emerged in 2021—a similarly widespread and severe security flaw found in Log4j, a popular Java logging framework.
A vulnerability in core PHP reaches far beyond a single application or enterprise network, according to the Wiz researchers. PHP runs across multi-cloud environments, independent hosting providers, content-delivery networks, and millions of independently managed enterprise and personal servers. Reducing total exposure before the technical details became public required an unprecedented level of coordinated work across that entire global technology ecosystem.
The SANS Internet Storm Center is closely monitoring the situation as major software platforms, Linux distributions, and hosting providers rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For a deeper technical dive on these vulnerabilities that outlines the timeline of their discovery in a creative format, security professionals can consult resources provided by Calif, another technology company credited with helping discover the PHP flaws. As the situation continues to develop rapidly, system administrators and webmasters worldwide remain on high alert to secure their infrastructure against ongoing automated attacks.
