Websites running PHP may return error pages today as administrators race to install an emergency update for two critical vulnerabilities in the programming language. According to Krebs on Security, roughly 70 percent of websites need the core software fix, which closes holes that let an attacker take full control of affected servers. Working exploits exist, and the bugs are already being used in attacks.
PHP released the emergency security update earlier today. The flaws affect PHP 5.4 and later and are tracked as CVE-2026-109618 and CVE-2026-109619. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP underpins sites running Drupal, Magento, Joomla and WordPress, among other web publishing systems.
Reuters reported that government websites in Europe and elsewhere went offline today after the vulnerabilities were disclosed. Cloudflare said it has already detected some exploitation and that at 3:02 am UTC it implemented web application firewall rules to shield sites from attack traffic. The bugs could cause a denial of service condition, remote code execution and data exposure.
OpenAI, which took part in the vulnerability research and outreach, said that given the severity of the flaws and PHP's widespread use, it considers this one of the most impactful security issues in recent memory. Security experts at Wiz said every PHP version released in the last decade is affected by at least one of the vulnerabilities. Wiz, which the source notes is an advertiser on the blog, was among several organizations credited with discovering the flaws.
In a blog post today, Wiz researchers wrote that the findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history. They said the underlying flaws had been present for decades, but demonstrating exploitability required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit, according to the researchers.
Wiz said the bugs will likely be mass-exploited to install web-based backdoors or web shells, which give attackers a web-based panel to remotely control infected sites. Before public disclosure, Wiz said it worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure. Wiz compared the pair to the Log4Shell weakness that emerged in 2021 in Log4j, a popular Java logging framework, and said PHP is so deeply embedded in many web applications that organizations will likely struggle to patch for some time.
The SANS Internet Storm Center is monitoring major software platforms shipping updates for the PHP flaws; Ubuntu has released updated PHP packages.
More cybersecurity news from TechManNews.
