PHP Zero-Day Flaws Cause Site Outages as Organizations Rush to Patch
Emergency PHP Zero-Day Patch Deployed to Prevent Server Takeovers
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI stated after helping coordinate the emergency response for a pair of critical vulnerabilities impacting core server infrastructure. Today, a widespread PHP flaw is causing site outages across the web as organizations rush to patch CVE-2026-109618 and CVE-2026-109619, two zero-day vulnerabilities that allow remote code execution and full server takeover on vulnerable systems.
The Tech TL;DR:
- The Vulnerabilities: Two critical bugs, tracked as CVE-2026-109618 and CVE-2026-109619, affect all web servers running PHP 5.4 or later, impacting platforms like WordPress, Drupal, Magento, and Joomla.
- The Blast Radius: Censys reported approximately 2.58 million internet-facing hosts and 54.9 million web properties running PHP, with Reuters noting government websites in Europe and globally went offline following disclosure.
- The Fix: Emergency security updates are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while Cloudflare deployed web application firewall rules to intercept active exploitation attempts.
Frontier AI Models Lower Exploitation Barriers for Decades-Old Code
Security researchers at Wiz noted that every PHP version released in the last decade is affected by at least one of these critical security bugs. In their published technical analysis, Wiz researchers emphasized the unique nature of the discovery: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The underlying code flaws had persisted for decades without active weaponization. Demonstrating exploitability previously required an exceptionally complex chain of steps at the edge of human research limits. According to Wiz, frontier AI models substantially reduced that barrier, transforming a longstanding theoretical flaw into a working exploit.
Prior to public disclosure, Wiz coordinated patch verification alongside the PHP team, Calif, and OpenAI. Censys scanning data identified roughly 2.58 million internet-facing hosts and 54.9 million web properties utilizing PHP. Because the language powers a massive share of content management systems and containerized microservices architectures, the exposure surface extends across multiple cloud providers and content-delivery networks.
Cloudflare Implements Firewall Rules as Government Websites Go Offline
Active exploitation of the zero-day flaws has already been detected by infrastructure providers. Cloudflare reported that it implemented web application firewall rules at 3:02 am UTC to protect client endpoints from incoming attack traffic designed to trigger denial-of-service conditions, remote code execution, and data exposure. Meanwhile, Reuters confirmed that government websites across Europe and other regions went offline immediately following the public advisory.
Industry analysts draw direct comparisons between the current PHP emergency and the Log4Shell crisis of 2021. Due to the deep embedding of PHP across diverse tech stacks, continuous integration pipelines, and legacy applications, remediation will likely require sustained engineering effort.
# Check current PHP version on remote nodes via SSH
php -v
# Update PHP core packages on Ubuntu-based production servers
sudo apt update && sudo apt install --only-upgrade php8.3 php8.3-common
PHP Team Releases Security Updates to Patch Remote Execution Risks
The PHP development team released emergency security updates to mitigate the remote code execution risks. The flaws are officially patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Downstream distributions are actively pushing compiled binaries; for instance, the SANS Internet Storm Center noted that Ubuntu has released updated PHP packages to address the CVE pair.
Security researchers warn that unpatched servers face imminent compromise via automated scripts designed to install web-based backdoors and web shells, granting persistent administrative access to malicious actors.
Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.