Critical PHP Vulnerabilities Trigger Widespread Site Outages and Exploitation — Cybersecurity

A pair of critical zero-day vulnerabilities in PHP is causing significant disruptions across the web, with experts confirming active exploitation. Nearly 70 percent of websites require immediate updates to prevent attackers from seizing full control of servers.

A severe security crisis is unfolding today as widespread PHP flaws cause numerous website outages and serve error pages. Experts warn that nearly 70 percent of websites must update their core software immediately to address two critical vulnerabilities that allow attackers to execute arbitrary code and seize full control over affected servers. Working exploits for these bugs are already confirmed to be in use in the wild.

The vulnerabilities impact PHP, the programming language powering major web publishing systems including Drupal, Magento, Joomla, and WordPress. In response, the PHP team released an emergency security update earlier today. The flaws affect all web servers running PHP version 5.4 or later and are tracked under CVE-2026-109618 and CVE-2026-109619. Patches have been issued in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The immediate impact has already been felt globally, with Reuters reporting that government websites in Europe and other regions went offline following the disclosure. Cloudflare detected active exploitation attempts early in the morning and implemented web application firewall rules at 3:02 am UTC to block attack traffic. These exploits pose risks of denial of service, remote code execution, and data exposure.

OpenAI, which participated in the research and outreach efforts, described the situation as one of the most impactful security issues in recent memory due to the severity of the flaws and PHP's ubiquity. Data from Censys indicates that approximately 2.58 million internet-facing hosts and 54.9 million web properties are currently running PHP. Security experts at Wiz noted that every PHP version released in the last decade is affected by at least one of these vulnerabilities.

Researchers at Wiz, who were credited with discovering the flaws alongside Calif and OpenAI, stated that the underlying bugs had existed for decades but required an exceptionally complex chain of steps to exploit. They highlighted that frontier AI models significantly reduced this barrier, turning a longstanding theoretical flaw into a practical exploit. The researchers anticipate mass exploitation aimed at installing web-based backdoors or "web shells" to remotely control infected sites.

The scale of the issue has drawn comparisons to the Log4Shell vulnerability from 2021. Wiz researchers emphasized that because PHP is deeply embedded across clouds, hosting providers, and content-delivery networks, organizations will likely struggle to patch these vulnerabilities for some time. The SANS Internet Storm Center is monitoring major platforms shipping updates, including recent package releases from Ubuntu.

Sources: Krebs on Security.