Critical PHP Flaws Trigger Emergency Patching Across 70% of Web Infrastructure

A pair of critical vulnerabilities discovered in PHP is driving widespread service disruptions as administrators scramble to deploy patches. The flaws affect approximately 70 percent of all websites globally, enabling attackers to gain complete control of compromised servers. Security researchers confirm that functional exploits are circulating and being deployed in active attacks.

The vulnerabilities reside in PHP, the scripting language underlying numerous web publishing platforms including Drupal, Magento, Joomla and WordPress. PHP released an emergency security update addressing the two critical defects, which permit arbitrary code execution on vulnerable infrastructure.

Government websites across Europe and beyond experienced outages following the public disclosure of these PHP flaws, according to Reuters. Cloudflare reported detecting active exploitation attempts and deployed web application firewall protections at 3:02 am UTC to block malicious traffic attempting to trigger denial of service conditions, execute remote code, or expose sensitive data.

OpenAI, which participated in vulnerability research and coordinated disclosure, characterized the issue as exceptionally serious. The organization stated: "given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory."

Researchers at Wiz determined that every PHP version released over the past decade carries vulnerability to at least one of these flaws. The team published analysis describing the issues as among the most dangerous ever identified in PHP and potentially in software development broadly.

According to Wiz's findings: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

Wiz anticipates that attackers will leverage these PHP vulnerabilities to deploy web shells—persistent backdoors granting remote administrative access to compromised websites. Before public disclosure, Wiz collaborated with the PHP development team, Calif and OpenAI to assess the scope of exposure and coordinate patching efforts.

The vulnerabilities are designated as CVE-2026-109618 and CVE-2026-109619, affecting all web servers running PHP 5.4 and later versions. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Wiz researchers noted that PHP's deep integration into web infrastructure means remediation will likely extend over an extended period, drawing parallels to the Log4Shell vulnerability discovered in 2021, which affected the widely-deployed Log4j Java logging library. The team emphasized: "A vulnerability in core PHP reaches far beyond a single application. PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem."

The SANS Internet Storm Center is monitoring major software vendors releasing patches for these PHP issues. Ubuntu has already published updated PHP packages addressing the vulnerabilities.