A critical security vulnerability affecting nearly 70% of websites built on the widely-used PHP programming language has been disclosed, with active exploitation already underway. Experts warn this could lead to widespread server compromises and significant website outages, making it one of the most impactful security issues in recent memory. PHP has released an emergency update to address two severe bugs that allow attackers to execute arbitrary code on vulnerable servers, essentially granting them full control.

The vulnerabilities, identified by CVE numbers CVE-2026-109618 and CVE-2026-109619, are present in all PHP versions released in the last decade, impacting a vast swathe of the internet. Prominent web publishing systems like Drupal, Magento, Joomla, and the immensely popular WordPress all rely on PHP, meaning millions of websites are potentially at risk. The severity of these flaws is underscored by the fact that they were only practically demonstrable with the assistance of advanced AI models, as noted by Wiz, one of the research organizations involved in their discovery.

"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," stated the Wiz research team in a blog post. "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

The implications of these vulnerabilities are dire. Attackers can leverage them to install web-based backdoors, often referred to as "web shells," which provide a remote control panel for infected sites. This allows for complete data exfiltration, unauthorized content modification, and the potential for further attacks originating from compromised servers. Cloudflare confirmed it has detected exploitation attempts and has implemented web application firewall (WAF) rules to mitigate attacks aimed at causing denial of service conditions, remote code execution, and data exposure.

Reuters reported that government websites in Europe and other regions were taken offline following the disclosure of the PHP vulnerabilities, highlighting the immediate and far-reaching impact. OpenAI, which collaborated on the vulnerability research and coordinated disclosure, emphasized the gravity of the situation. "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory," the company stated.

Censys, a firm that monitors internet infrastructure, revealed the sheer scale of the potential impact. A recent scan identified approximately 2.58 million internet-facing hosts and a staggering 54.9 million web properties running PHP. Wiz further elaborated that every PHP version from the last ten years is affected by at least one of the two critical vulnerabilities.

The affected versions of PHP are 5.4 and later. The critical bugs have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, the deep integration of PHP into countless web applications means that patching these vulnerabilities will be a significant undertaking for organizations worldwide. Security experts liken the potential fallout to the Log4Shell vulnerability that emerged in 2021, a critical flaw in the widely used Java logging library, Log4j, which also led to widespread exploitation and extensive patching efforts.

"A vulnerability in core PHP reaches far beyond a single application," the Wiz researchers emphasized. "PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."

The SANS Internet Storm Center is actively tracking major software platforms as they release updates to address these PHP flaws. For instance, Ubuntu has already pushed out updated PHP packages. For those seeking a detailed technical breakdown and a visual timeline of the discovery, a comic book-style presentation is available from Calif, another organization credited with uncovering these critical bugs.

The PHP vulnerabilities, now assigned CVE-2026-109618 and CVE-2026-109619, represent a significant threat to the digital landscape. The urgency for website administrators and developers to update their PHP installations cannot be overstated. Failure to do so leaves servers exposed to attackers who are actively seeking to exploit these weaknesses for malicious purposes. The widespread nature of PHP means that this incident will likely have long-lasting repercussions, with organizations facing a protracted battle to secure their online assets. The rapid nature of the exploitation and the deep-seated reliance on PHP suggest that many websites may indeed serve error pages for an extended period as the internet community scrambles to patch this critical vulnerability.