A critical wave of vulnerabilities discovered in PHP, the ubiquitous programming language powering a vast majority of the internet’s websites, has prompted an emergency security update and is poised to cause significant disruption, potentially leading to widespread site outages and server compromises. Experts warn that nearly 70 percent of websites are vulnerable to these two critical bugs, which allow attackers to gain complete control over affected servers. Working exploits are already in the wild, and malicious actors are actively exploiting these flaws.

The affected programming language, PHP, is the backbone of many popular web publishing systems, including but not limited to Drupal, Magento, Joomla, and WordPress. In response to the severity of the situation, PHP has released an urgent security patch to address two critical vulnerabilities that permit attackers to execute arbitrary code on vulnerable servers. This emergency update aims to mitigate the immediate threat posed by these deeply embedded flaws.

The implications of this discovery are already being felt globally. Reuters reports that government websites across Europe and other regions have been forced offline following the disclosure of these PHP vulnerabilities. Cloudflare, a major content delivery network and security provider, has confirmed detecting exploitation attempts and has implemented web application firewall (WAF) rules to protect its clients from attacks targeting these bugs. These attacks can lead to denial of service conditions, remote code execution, and significant data exposure.

OpenAI, an organization involved in the vulnerability research and coordinated disclosure process, has characterized the situation as one of the most impactful security issues in recent memory, given PHP’s pervasive use. Their involvement highlights the advanced nature of the discovery and the potential for sophisticated exploitation.

Censys, a firm specializing in tracking internet-facing technology, has provided stark statistics on the scale of the problem. A recent scan revealed approximately 2.58 million internet-facing hosts and an astonishing 54.9 million web properties running PHP. This data underscores the immense attack surface exposed by these vulnerabilities.

Security experts at Wiz, an advertising partner of Krebs on Security, have stated that every PHP version released over the past decade is affected by at least one of these vulnerabilities. This broad impact means that a significant portion of the internet’s infrastructure is at risk.

The Wiz research team described these findings as among the most severe vulnerabilities ever discovered in PHP, and potentially in software history. Their blog post details how, while the underlying flaws existed for decades, demonstrating their exploitability required an exceptionally complex chain of steps. It was the advancement of frontier AI models that significantly reduced this barrier, transforming a long-standing weakness into a readily exploitable vulnerability.

The researchers at Wiz anticipate that these PHP vulnerabilities will be aggressively exploited for mass installation of web-based backdoors, commonly known as "web shells." These malicious tools provide attackers with a web-based control panel, enabling them to remotely manage and control compromised websites. Prior to the public disclosure, Wiz collaborated with the PHP team, Calif, and OpenAI to assess the scope of the issue and coordinate the verification and release of patches.

These zero-day vulnerabilities are officially designated as CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP version 5.4 and later. The critical fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The deep integration of PHP into countless web applications means that organizations are likely to face a prolonged and challenging struggle to patch these vulnerabilities. Wiz draws a parallel between this PHP vulnerability pair and the Log4Shell weakness that emerged in 2021, a similarly widespread and critical security flaw in the Log4j Java logging framework.

The Wiz researchers emphasize that a vulnerability in core PHP extends far beyond a single application. PHP’s presence across clouds, hosting providers, content-delivery networks, and millions of independently managed servers means that mitigating exposure requires a coordinated effort across the entire internet ecosystem.

The SANS Internet Storm Center is actively monitoring major software platforms that are releasing updates to address these PHP flaws. For instance, Ubuntu has already issued updated PHP packages. A detailed technical analysis of these vulnerabilities, including a comic-book-style timeline of their discovery, is available in a post from Calif, another technology company credited with identifying these critical bugs.

Censys has launched a dedicated website, php2shell.censys.com, to track the ongoing impact and scope of these PHP vulnerabilities, providing a real-time visualization of the threat landscape.

This is a fast-moving story. Updates will be noted here with timestamps.

Update, 2:30 pm ET: Figures from Censys and a link to Calif’s detailed write-up have been added to this report.