Critical PHP Vulnerabilities Threaten Widespread Website Exploitation
Websites globally are at risk today as two critical vulnerabilities in the PHP programming language have been disclosed, with experts warning of active exploitation and potential widespread outages. Nearly 70 percent of websites are estimated to require software updates to patch these flaws, which could allow attackers to seize full control over affected servers. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect all web servers running PHP 5.4 or later.
Details
PHP has released an emergency security update to address the two critical bugs. These flaws enable attackers to execute arbitrary code on vulnerable servers, leading to potential denial of service conditions, remote code execution, and data exposure. Security firm Wiz, which was instrumental in discovering the vulnerabilities, stated that every PHP version released in the last decade is affected by at least one of these issues. The bugs are fixed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Context
The programming language PHP powers a vast array of popular web publishing systems, including Drupal, Magento, Joomla, and WordPress. Reuters reported that government websites in Europe and elsewhere experienced downtime following the disclosure. Cloudflare confirmed it detected exploitation attempts and implemented web application firewall rules to mitigate attacks. OpenAI, involved in the vulnerability research, described the situation as "one of the most impactful security issues in recent memory" due to PHP's pervasive use. Censys estimates that approximately 2.58 million internet-facing hosts and 54.9 million web properties run PHP.
Impact
Security experts at Wiz warn that these vulnerabilities are likely to be mass-exploited to install web-based backdoors, often referred to as "web shells," granting attackers remote control over compromised sites. The researchers noted that the underlying flaws had existed for decades but required a complex chain of steps to exploit until recent advancements, including AI models, made them more accessible. The deep integration of PHP across the internet means organizations will likely face significant challenges in patching these vulnerabilities, a situation being compared to the widespread impact of the Log4Shell vulnerability in 2021. "A vulnerability in core PHP reaches far beyond a single application," the Wiz researchers emphasized, highlighting its presence across clouds, hosting providers, and numerous independent servers.
What's Next
The SANS Internet Storm Center is monitoring major software platforms as they release updates to address these PHP flaws, with operating systems like Ubuntu already shipping updated packages. Companies like Calif have also published detailed technical write-ups on the discovery timeline of these bugs. Given the severity and widespread nature of the vulnerabilities, ongoing efforts will focus on rapid patch deployment and monitoring for further exploitation.
