“Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers.” That stark figure — lifted from the reporting on today’s disclosures — frames an incident that is already producing outages and active exploitation across the web.
PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619
Earlier today PHP released an emergency security update addressing two critical bugs tracked as CVE-2026-109618 and CVE-2026-109619. According to the reporting, the flaws permit attackers to execute code of their choosing on vulnerable servers; that capability can produce denial of service conditions, remote code execution, and data exposure.
The advisory notes that working exploits exist and that the vulnerabilities “are already being exploited in the wild.” The scope of the problem is large by design: the bugs affect all web servers running PHP 5.4 or later.
Scope: PHP across Drupal, Magento, Joomla, WordPress and hosting stacks
PHP powers sites built on widely used publishing systems, explicitly including Drupal, Magento, Joomla and WordPress. Because PHP is embedded across clouds, hosting providers, content-delivery networks and “millions of independently managed servers,” the weaknesses reach far beyond a single application or hosting relationship, researchers said.
Security researchers at Wiz — one of the groups credited with discovering the flaws — warned that the vulnerabilities are likely to be mass-exploited to install web-based backdoors or “web shells,” which provide attackers with remote control panels on infected sites.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadMitigations: emergency updates and packages (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35)
PHP’s emergency updates fix the problems in released builds: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The SANS Internet Storm Center is monitoring major software platforms as they ship updates, and some distributions are already distributing patched packages — for example, Ubuntu released updated PHP packages today.
Wiz noted the practical challenge: “PHP is so deeply embedded in many web applications that we are likely to see organizations struggling to patch these vulnerabilities for some time to come,” comparing the pair of holes to the widespread Log4Shell weakness of 2021.
Responses from Cloudflare, OpenAI, Wiz, Reuters and others
Cloudflare reported detecting some exploitation and said it implemented web application firewall (WAF) rules at 3:02 am (UTC) to protect websites from attack traffic aimed at the bugs. Reuters reported that government websites in Europe and elsewhere went offline after the vulnerabilities were disclosed.
OpenAI — which the reporting says was involved in the vulnerability research and outreach — summarized the scale in blunt terms: “given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”
The Wiz research team framed the discovery and disclosure process in technical and cooperative terms: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” the team wrote in a blog post. They added that the underlying flaws “had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Wiz also said it worked with the PHP team, Calif and OpenAI prior to public disclosure to measure the size of the problem and to coordinate patch verification and disclosure. Full disclosure: Wiz is an advertiser on the blog that published the original report.
What this means for technologists, hosting providers, and government website operators
- Technologists and security teams: Apply the emergency PHP updates immediately — the fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — and monitor for web shells and unauthorized code execution, since working exploits are reported in the wild.
- Hosting providers and CDNs: Expect a patch-and-remediation surge. Cloudflare’s rapid WAF deployment and Ubuntu’s updated packages show two mitigation paths — temporary WAF protections and distribution-level package updates — but Wiz warns that many independently managed servers will remain exposed for some time.
- Government website operators: Reuters reported outages to government sites in Europe and elsewhere; those operators will need to coordinate emergency patching and incident response as multiple public-sector sites can be affected simultaneously.
This is a fast-moving incident with a large attack surface: decades-long flaws, working exploits, and an ecosystem of servers that do not patch uniformly. The PHP team published fixes and third parties — from Cloudflare to Ubuntu — have taken steps to blunt immediate exploitation. The remaining question, underscored by comparisons to Log4Shell and the practical difficulty of updating millions of servers, is how long it will take the web to move from emergency mitigation to comprehensive remediation.
