Expect to see quite a few websites serving error pages and unexpected downtime today, as administrators around the world race to implement urgent software patches. Nearly 70 percent of websites globally are estimated to require immediate core software updates to fix a pair of severe vulnerabilities that allow an unauthorized attacker to seize full control over affected servers. Cybersecurity experts warn that working exploits for these critical bugs already exist in the wild and are actively being leveraged by malicious actors.
The newly disclosed flaws reside in PHP, the widely used open-source scripting and programming language that forms the foundational backbone of the modern web. PHP powers millions of sites running on popular web publishing systems, content management platforms, and e-commerce frameworks, including WordPress, Drupal, Magento, and Joomla. In response to the discovery, the PHP development team released an emergency security update earlier today to address two critical bugs that enable attackers to execute arbitrary code of their choosing directly on a vulnerable web server.
International news reports indicate that government websites in Europe and various other regions went offline or experienced significant disruptions as system administrators scrambled to respond after the PHP vulnerabilities were made public. Major internet infrastructure and security companies have also mobilized. Cloudflare announced that it had already detected active exploitation attempts targeting the flaws. In response, the company implemented specialized web application firewall rules to protect customer websites from incoming attack traffic designed to exploit the bugs, which could lead to severe outcomes including denial of service conditions, remote code execution, and unauthorized data exposure.
Artificial intelligence research organizations were also deeply involved in uncovering the threat. OpenAI, which participated in the coordinated vulnerability research and outreach efforts, noted the extraordinary scale and severity of the issue. Given the widespread reliance on PHP across the global digital infrastructure, OpenAI representatives described the situation as one of the most impactful security issues witnessed in recent memory.
Internet scanning and asset tracking firms have begun quantifying the massive potential surface area of the threat. Censys reported that a recent scan identified approximately 2.58 million internet-facing hosts and 54.9 million individual web properties running PHP worldwide. Meanwhile, security researchers at Wiz emphasized that virtually every PHP version released over the past decade is affected by at least one of these vulnerabilities.
In a comprehensive analysis published today, researchers at Wiz—who were among the multiple organizations credited with discovering the vulnerabilities—noted that these findings rank among the most severe security flaws ever uncovered in PHP, and arguably in the broader history of software development. According to the Wiz research team, the underlying structural flaws had actually been present in the language for decades. However, demonstrating their practical exploitability previously required an exceptionally complex chain of steps at the absolute edge of what human researchers could practically achieve. The integration of frontier AI models substantially reduced that technical barrier, effectively turning a longstanding theoretical flaw into a functional exploit.
The Wiz researchers warn that the PHP vulnerabilities will likely face mass exploitation campaigns aimed at installing web-based backdoors or web shells. These malicious interfaces provide attackers with a remote control panel, allowing them to maintain persistent access and manage infected sites from afar. Prior to the public disclosure of the bugs, Wiz collaborated closely with the PHP security team, Calif, and OpenAI to accurately measure the scope of the problem, verify effective patches, and coordinate a synchronized global disclosure.
The critical PHP zero-day vulnerabilities are being tracked under identifiers CVE-2026-109618 and CVE-2026-109619. They impact all web servers operating on PHP versions 5.4 and later. Official patches have been rolled out and are included in the newly released versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Because PHP is so deeply embedded into the architecture of countless web applications, frameworks, and hosting environments, security analysts anticipate that organizations will struggle with the remediation process for a significant period. Experts have drawn comparisons between this unfolding PHP vulnerability pair and the infamous Log4Shell weakness that emerged in late 2021, which targeted the widely used Log4j Java logging framework and triggered a multi-year global patching effort.
As the Wiz researchers pointed out in their technical advisory, a vulnerability residing in core PHP reaches far beyond any single application or isolated web service. PHP operates seamlessly across complex cloud environments, hosting provider infrastructures, content-delivery networks, and millions of independently managed servers worldwide. Reducing exposure before technical details became public required an unprecedented level of coordinated cooperation across that entire technological ecosystem.
Meanwhile, monitoring bodies such as the SANS Internet Storm Center are closely tracking major software platforms, Linux distributions, and hosting ecosystems as they rush to ship updated packages to deal with the PHP flaws. For instance, Ubuntu has already released updated PHP packages to safeguard its user base. Organizations seeking a technical deep-dive into the discovery timeline and mechanics of these bugs can also review specialized breakdowns provided by Calif, another technology company credited with identifying the PHP vulnerabilities.
As this remains a fast-moving and continuously developing story, infrastructure providers and system administrators continue to urge immediate patching and monitoring of all PHP-dependent environments.
