Internet users across the globe are facing widespread disruptions and error pages today as a massive segment of the web’s infrastructure scrambles to secure itself against a pair of critical vulnerabilities. Security experts warn that roughly 70 percent of websites worldwide require immediate core software updates to fix two severe flaws that grant attackers the ability to seize full control over affected servers. With working exploits already circulating, cybersecurity authorities confirm that these dangerous bugs are actively being leveraged in attacks in the wild, triggering emergency responses from governments, cloud providers, and software maintainers alike.
The vulnerabilities reside in PHP, the foundational programming language that powers an enormous share of the modern internet. PHP serves as the computational backbone for millions of web publishing systems, content management platforms, and e-commerce applications, including widely used platforms like WordPress, Drupal, Magento, and Joomla. In response to the crisis, the PHP development team released an emergency security update earlier today to patch the two critical bugs, which allow malicious actors to execute arbitrary code of their choosing on any vulnerable web server.
Government websites in Europe and various other regions experienced sudden outages today following the public disclosure of the PHP vulnerabilities, as administrators rushed to take systems offline or apply emergency fixes. Meanwhile, infrastructure and security giant Cloudflare reported that it had already detected exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to shield protected websites from incoming attack traffic. According to security advisories, failing to mitigate the issue leaves systems vulnerable to remote code execution, severe data exposure, and catastrophic denial-of-service conditions.
Artificial intelligence pioneer OpenAI, which actively participated in the vulnerability research and coordinated outreach efforts, emphasized the sheer magnitude of the threat. Given the critical severity of these security gaps and the ubiquity of PHP across the global digital landscape, OpenAI characterized the situation as one of the most impactful security issues witnessed in recent memory.
Data compiled by internet-scanning firm Censys underscores the staggering scale of the potential attack surface. A recent scan conducted by the company identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP. Furthermore, security researchers at Wiz noted that virtually every single version of PHP released over the past decade is affected by at least one of these newly disclosed vulnerabilities.
Describing the discovery in a comprehensive blog post, the Wiz research team stated that these findings rank among the most severe vulnerabilities ever uncovered in PHP, and arguably in the history of software development. The researchers explained that the underlying security flaws had actually been present within the language for decades. However, demonstrating their practical exploitability previously required an exceptionally complex, multi-step chain of conditions that sat right at the absolute edge of what human security researchers could practically achieve. According to Wiz, the deployment of frontier AI models substantially reduced that technical barrier, effectively transforming a longstanding theoretical flaw into a dangerous, weaponized exploit.
The Wiz research team cautions that the newly revealed PHP vulnerabilities are likely to face widespread, automated mass-exploitation. Attackers are expected to leverage the flaws to install persistent, web-based backdoors known as web shells, which provide malicious actors with a convenient graphical panel to maintain remote control over compromised websites. Prior to the public disclosure of these bugs, Wiz collaborated closely with the PHP core team, tech firm Calif, and OpenAI to evaluate the true scope of the problem and coordinate both patch verification and responsible disclosure timelines.
Tracked officially by their assigned identifiers as CVE-2026-109618 and CVE-2026-109619, these zero-day vulnerabilities affect all web servers running PHP versions 5.4 and later. The core development team has issued patches in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to remediate the issues.
Because PHP is so deeply interwoven into the architecture of modern web applications, Wiz experts predict that organizations will struggle to patch their environments for an extended period. Industry analysts have naturally drawn comparisons between this unfolding PHP crisis and the infamous Log4Shell weakness that sent shockwaves through the technology sector in 2021—a similarly pervasive and severe vulnerability found within the popular Java logging framework Log4j.
A vulnerability residing in core PHP reaches far beyond any single application or isolated web service, the Wiz researchers explained. PHP is deployed extensively across cloud environments, commercial hosting providers, content-delivery networks, and millions of independently administered servers worldwide. Mitigating exposure and distributing patches before technical details leaked required tightly coordinated cooperation across the entire technology ecosystem.
Meanwhile, the SANS Internet Storm Center is closely monitoring major software distributions and platforms as they rush out updated packages to deal with the PHP flaws. Linux distributions such as Ubuntu have already begun rolling out updated PHP packages to their repositories. For a detailed technical breakdown of how the vulnerabilities were uncovered, security professionals have pointed to a comic-book-style timeline published by Calif, a technology company that shared credit for discovering the bugs.
As system administrators around the world work frantically to apply updates and verify server integrity, the digital landscape remains on high alert. The situation continues to develop rapidly as hosting providers and enterprise networks gauge their exposure to one of the most critical software threats in recent history.
Leave a Reply