# Critical PHP Vulnerabilities Threaten Millions of Websites, Exploits Detected IT security professionals and privacy-conscious users are urged to take immediate action following the disclosure of two critical vulnerabilities in **PHP**, the widely used programming language underpinning a vast majority of the internet. These flaws, which allow for full server compromise, are already being exploited in the wild.  ## The Core Vulnerabilities The vulnerabilities impact **PHP** itself, the language powering popular content management systems like **Drupal**, **Magento**, **Joomla**, and **WordPress**. Earlier today, **PHP** released an emergency security update addressing these critical bugs. Successful exploitation could lead to arbitrary code execution on vulnerable servers. **Reuters** reported that government websites across Europe and elsewhere experienced downtime following the disclosure. **Cloudflare** confirmed detecting exploitation attempts and swiftly implemented Web Application Firewall (WAF) rules at 3:02 AM UTC to protect against attack traffic, which could result in denial of service, remote code execution, and data exposure. ## A 'Most Impactful Security Issue' **OpenAI**, involved in the vulnerability research and outreach, described this as "one of the most impactful security issues in recent memory" given the severity and **PHP**'s pervasive use. **Censys**, a firm that maps internet hosts, identified approximately 2.58 million internet-facing hosts and 54.9 million web properties running **PHP** in a recent scan. Security experts at **Wiz** stated that every **PHP** version released in the last decade is affected by at least one of these vulnerabilities. Researchers at **Wiz**, credited with discovering the flaws, published a blog post calling these findings "among the most severe vulnerabilities discovered in **PHP**, and arguably in software history." ## The Role of AI in Discovery The **Wiz** team noted that while the underlying flaws had existed for decades, demonstrating their exploitability required an exceptionally complex chain of steps. They highlighted that "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit." It is highly probable that these **PHP** vulnerabilities will be mass-exploited to install web-based backdoors or "web shells," providing attackers with remote control over infected sites. Prior to public disclosure, **Wiz** collaborated with the **PHP** team, **Calif**, and **OpenAI** to assess the scope and coordinate patch verification. ## Patching is Paramount The **PHP** zero-day vulnerabilities are tracked as **CVE-2026-109618** and **CVE-2026-109619**. They affect all web servers running **PHP 5.4** or later. Patches are available in **PHP 8.5.12**, **8.4.27**, **8.3.36**, and **8.2.35**. Organizations are strongly advised to update immediately. **Wiz** researchers draw parallels between these **PHP** vulnerabilities and the **Log4Shell** weakness of 2021, predicting that organizations will struggle with patching due to **PHP**'s deep integration across various web applications. "A vulnerability in core **PHP** reaches far beyond a single application," the researchers emphasized, underscoring the need for coordinated action across clouds, hosting providers, CDNs, and millions of independently managed servers. The **SANS Internet Storm Center** is actively monitoring major software platforms releasing updates for these **PHP** flaws, with **Ubuntu** already releasing updated **PHP** packages. For a technical deep-dive into the discovery timeline, **Calif**, another company credited with finding the flaws, has published a comic book-style write-up.  *A snapshot of php2shell.censys.com, the website Censys set up to track the PHP vulnerabilities.* This is a fast-moving story, and updates will be provided as new information becomes available. *Update, 2:30 pm ET: Added figures from Censys and a link to Calif's writeup.*