Nearly 70 percent of websites require urgent core software updates to patch two critical PHP vulnerabilities that permit full server takeovers. Government portals across Europe and international web properties have already gone offline as active exploits sweep the internet, threatening widespread application outages.
Emergency Patches Deploy for Two Decades-Old Flaws
The programming language powering massive publishing ecosystems like WordPress, Joomla, Magento, and Drupal finds itself at the center of an unprecedented security crisis. PHP released emergency security patches to eradicate two critical bugs designated as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities affect every web server running PHP 5.4 or later, exposing a massive footprint of digital infrastructure.
Censys scanning data shows approximately 2.58 million internet-facing hosts and 54.9 million web properties utilize PHP. Security firm Wiz notes that every single PHP version released across the last decade remains vulnerable to at least one of these flaws. The underlying weaknesses persisted in the codebase for decades because weaponizing them previously demanded an exceptionally complex chain of human-engineered steps.
Frontier Artificial Intelligence Lowers the Exploit Barrier
Frontier AI models substantially altered the threat environment. Wiz researchers report that advanced artificial intelligence reduced the technical barriers required to turn a legacy flaw into a working exploit. OpenAI participated directly in vulnerability research and outreach, declaring the situation one of the most impactful security issues in recent memory due to PHP’s pervasive global deployment.
Cloudflare detected active exploitation attempts immediately following disclosure. At 3:02 am UTC, the platform deployed web application firewall rules to block traffic aimed at triggering remote code execution, denial of service conditions, and severe data exposure. Organizations slow to apply the emergency fixes face immediate risks of attackers installing web-based backdoors and remote control panels known as web shells.
Global Ecosystem Scrambles to Mitigate the Exposure
Security analysts compare the scale of this emergency to the 2021 Log4Shell event. Because PHP embeds deeply into various cloud environments, content delivery networks, and hosting providers, remediation demands synchronized ecosystem-wide coordination. Ubuntu and other major platform vendors are actively shipping updated packages to address the crisis.
The SANS Internet Storm Center continues monitoring platform updates as developers race to secure their infrastructure. Affected operators must upgrade immediately to the newly released patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The PHP zero-day vulnerabilities are tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619.
