Webmasters and system administrators across the global internet are racing to update their server environments after the disclosure of a pair of critical vulnerabilities in PHP, the foundational programming language that powers a massive share of the world’s websites. Security researchers, infrastructure providers, and government agencies have warned that the flaws allow an attacker to seize full control over affected servers, execute arbitrary code, trigger denial-of-service conditions, and expose sensitive data.
With working exploits already circulating and active exploitation detected in the wild, internet security organizations are drawing comparisons to historic software crises like the infamous Log4Shell vulnerability of 2021. Government websites in Europe and various other regions went offline as emergency mitigation measures were hastily deployed, while major cloud and security firms scrambled to implement defensive firewall rules to block incoming attack traffic targeting the bugs.
The vulnerabilities reside in core PHP, the widely utilized scripting language that underpins a vast majority of web publishing platforms, content management systems, and enterprise frameworks, including WordPress, Drupal, Magento, and Joomla. In response to the crisis, the PHP development team released an emergency security update earlier today, urging administrators to patch their environments immediately to prevent complete server compromise.
The severity of the situation prompted OpenAI, which participated in vulnerability research and coordinated disclosure efforts, to publicly state that given the pervasive nature of PHP and the critical severity of these flaws, the issue ranks as one of the most impactful security events in recent memory. Censys, a specialized internet-scanning and host-tracking organization, reported that a recent assessment identified approximately 2.58 million internet-facing hosts and 54.9 million distinct web properties running PHP globally.
Security specialists at Wiz noted that every single major version of PHP released over the past decade is impacted by at least one of these critical vulnerabilities. In a detailed advisory published by Wiz—which was among several security organizations credited with discovering the bugs alongside Calif and OpenAI—researchers described the flaws as ranking among the most severe ever uncovered in PHP or software history as a whole.
According to the Wiz analysis, the underlying software defects had technically been present in the codebase for decades, but developing a reliable, working exploit previously required an exceptionally complex chain of operational steps at the absolute cutting edge of human research capabilities. However, the involvement of frontier artificial intelligence models substantially reduced that technical barrier, effectively transforming a latent, long-standing programming flaw into an active and operational exploit chain.
Researchers warn that these zero-day vulnerabilities are prime candidates for automated, large-scale mass exploitation campaigns. Attackers are expected to leverage the flaws to install persistent, web-based backdoors and web shells, which provide malicious actors with a convenient web-based administrative panel to remotely command and control compromised web servers at will. Prior to the public disclosure, Wiz collaborated closely with the PHP core team, Calif, and OpenAI to evaluate the scope of the exposure, verify emergency patches, and orchestrate a coordinated disclosure timeline.
The critical zero-day vulnerabilities are currently being tracked under Common Vulnerabilities and Exposures designations CVE-2026-109618 and CVE-2026-109619. They affect all web servers operating on PHP versions 5.4 and later. The PHP development team has officially addressed and patched the vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Due to PHP’s deeply ingrained presence across contemporary web architecture, security professionals anticipate that organizations worldwide will struggle to apply patches across complex, legacy environments for an extended period. Because core PHP functions as an foundational layer rather than an isolated application, a vulnerability in the language itself ripples far beyond individual websites, impacting cloud platforms, enterprise hosting providers, content-delivery networks, and millions of independently maintained servers alike. This systemic risk has led industry analysts to compare the current PHP crisis directly to the widespread disruption caused by the Log4Shell vulnerability in the Java logging framework five years prior.
As the situation continues to evolve rapidly, major technology vendors and Linux distributions are issuing updated packages to safeguard their users. Ubuntu and other operating system maintainers have begun shipping updated PHP packages, while the SANS Internet Storm Center has elevated its monitoring status to keep a close watch on software platforms releasing emergency patches. Meanwhile, technology firm Calif has published a comprehensive technical deep-dive into the timeline and mechanics of the discovery, presenting the complex security research in a visually descriptive format. Security agencies and infrastructure monitors like Censys continue to track vulnerable hosts online as system administrators work frantically to secure their digital perimeters against ongoing exploitation attempts.
