Expect to see quite a few websites serving error pages today as administrators rush to secure their infrastructure against a sweeping cyber threat. Nearly 70 percent of all websites face the urgent task of updating their core software to fix a pair of severe vulnerabilities that allow an unauthorized attacker to seize full control over affected servers. Cybersecurity experts have confirmed that working exploits for these flaws already exist, and warn that these critical bugs are actively being exploited in the wild, forcing a scramble across the global web hosting ecosystem.
The vulnerabilities at the center of this crisis reside within PHP, the ubiquitous server-side programming language that powers a massive share of the internet. PHP forms the foundational backbone for countless sites running on popular web publishing systems, content management frameworks, and e-commerce platforms, including Drupal, Magento, Joomla, and WordPress. In response to the discovery, the PHP development team released an emergency security update earlier today to patch two critical bugs capable of granting malicious actors the ability to execute arbitrary code of their choosing on any vulnerable web server.
The global impact of the disclosure was felt immediately. According to reports from Reuters, government websites in Europe and various other regions went offline as authorities chose to take systems down proactively while PHP prepared and distributed emergency patches. Meanwhile, network security and cloud infrastructure giant Cloudflare reported that it had already detected active exploitation attempts targeting the flaws. At 3:02 am UTC, Cloudflare implemented specialized web application firewall rules designed to shield protected websites from incoming attack traffic specifically crafted to exploit the bugs, which are capable of triggering devastating denial-of-service conditions, remote code execution, and unauthorized data exposure.
OpenAI, which played a direct role alongside security researchers in investigating the vulnerabilities and coordinating outreach, noted the unprecedented nature of the discovery. Given the immense severity of these flaws coupled with PHP’s massive, deeply entrenched market share across the global internet, OpenAI officials stated that they consider this to be one of the most impactful and far-reaching security issues in recent memory.
Data from Censys, a digital infrastructure and attack surface management company that tracks the underlying technologies used by internet hosts, highlights the sheer scale of the potential exposure. A recent scan conducted by Censys identified approximately 2.58 million internet-facing hosts and an astonishing 54.9 million web properties running PHP, illustrating just how broad the attack surface is for administrators and security teams racing to apply updates.
Security analysts at Wiz further emphasized the breadth of the issue, noting that virtually every PHP version released over the past decade is affected by at least one of these critical vulnerabilities. In a detailed blog post published today, a team of researchers at Wiz—who were officially credited among the several organizations that discovered the bugs—did not mince words regarding the severity of their findings. The Wiz team described the issues as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably in the broader history of software engineering.
According to the Wiz research team, the underlying software flaws had actually been present within the PHP codebase for decades. However, demonstrating their exploitability previously required an exceptionally complex and intricate chain of steps that sat right at the edge of what human researchers could practically achieve on their own. The researchers revealed that frontier artificial intelligence models substantially reduced that technical barrier, effectively turning a longstanding, theoretical flaw into a viable and dangerous exploit.
Furthermore, Wiz researchers warn that the PHP vulnerabilities are likely to be mass-exploited by malicious actors seeking to install web-based backdoors or web shells. These malicious interfaces provide attackers with a discrete web-based administrative panel that grants them persistent remote control over infected sites long after the initial breach. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem and coordinate both patch verification and responsible disclosure.
The critical PHP zero-day vulnerabilities are currently being tracked under official identifiers CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP versions 5.4 or later. To remediate the vulnerabilities, administrators must upgrade to the newly released patched versions, which include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply embedded into the architecture of modern web applications, Wiz experts predict that organizations will struggle to patch these vulnerabilities completely for quite some time. Industry analysts have naturally drawn comparisons between this unfolding crisis and the infamous Log4Shell weakness that emerged in 2021—a similarly widespread and severe security flaw found in Log4j, a popular Java logging framework.
As the Wiz researchers pointed out, a security vulnerability residing in core PHP reaches far beyond any single standalone application. PHP operates across complex cloud environments, hosting providers, content delivery networks, and millions of independently managed servers worldwide. Successfully reducing exposure before technical exploit details became fully public required unprecedented, coordinated remediation work across that entire interconnected ecosystem.
Meanwhile, the SANS Internet Storm Center is closely monitoring the situation as major software platforms and Linux distributions ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages for its user base. For those seeking a technical deep-dive into the vulnerabilities alongside a chronological look at how the bugs were discovered, technology company Calif—another organization credited with finding the flaws—has published an investigative write-up structured in a distinctive comic book style.
As this remains a fast-moving, developing story across the cybersecurity landscape, infrastructure administrators continue to monitor server logs, apply emergency patches, and verify defenses against ongoing scanning and exploitation attempts.
