WordPress<\/strong>. Any site built on or using these platforms is potentially vulnerable if running an unpatched version of PHP. The flaws also affect countless custom web applications, content management systems, and e-commerce platforms that rely on PHP. The SANS Internet Storm Center is actively monitoring major software platforms shipping updates to address the vulnerabilities. Ubuntu, for example, has already released updated PHP packages for its supported distributions.<\/p>\nThe vulnerabilities are not limited to specific hosting environments. PHP runs across clouds, hosting providers, content-delivery networks, and millions of independently managed servers. This widespread embeddedness means that patches must be applied at every layer of the stack, from shared hosting to dedicated servers to containerized deployments. Reducing exposure before the technical details became public required coordinated work across the entire ecosystem, according to Wiz.<\/p>\n
What Are the Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619?<\/h2>\n
CVE-2026-109618 and CVE-2026-109619 are two remote code execution vulnerabilities in the PHP programming language. Both allow an attacker to execute arbitrary code on a vulnerable server without authentication. They affect all PHP versions from 5.4 onward, spanning over a decade of releases. The bugs were discovered through a coordinated research effort and were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation has been confirmed in the wild, and mass exploitation is expected to follow. Organizations should apply the patches immediately and check for signs of compromise.<\/p>\n
Comparison to Log4Shell and the Long Tail of Patching<\/h2>\n
Security researchers at Wiz have drawn direct comparisons between these PHP vulnerabilities and the Log4Shell weakness that emerged in 2021. Log4Shell was a critical vulnerability in the Log4j Java logging framework that affected millions of applications and required months of widespread patching. Wiz researchers warned that PHP is so deeply embedded in many web applications that organizations are likely to struggle to patch these vulnerabilities for a considerable period. The long tail of unpatched systems could extend for years, leaving a persistent attack surface for threat actors.<\/p>\n
The complexity of the exploitation chain previously kept these flaws from being weaponized. However, the involvement of frontier AI models in demonstrating the exploitability represents a significant shift. OpenAI, which was involved in the vulnerability research and outreach, stated that given the severity of these flaws and PHP’s widespread use, they consider this one of the most impactful security issues in recent memory.<\/p>\n
How Exploitation Works and What Attackers Can Do<\/h2>\n
The exact technical details of the exploitation chain have been documented by Calif in a comic-style writeup that also provides the timeline of discovery. The attack allows a remote, unauthenticated attacker to execute arbitrary PHP code on a vulnerable server. This can be used to install web shells, which are persistent backdoors accessible through a web interface. Once a web shell is installed, an attacker can execute system commands, upload and download files, escalate privileges, pivot to other systems on the same network, and exfiltrate data.<\/p>\n
Because the vulnerabilities affect the core PHP interpreter rather than a specific application, they bypass many traditional security controls. Web application firewalls may be able to detect and block some exploit attempts, but the most reliable mitigation is to apply the security update. Cloudflare has already deployed WAF rules, but these are a stopgap measure, not a substitute for patching.<\/p>\n
Urgent Advice for Website Owners and Administrators<\/h2>\n
Every organization that operates a PHP-based website should treat this as a critical incident. The first step is to identify all systems running PHP and determine their version. Servers running PHP 5.4 through 8.5.11, 8.4.26, 8.3.35, or 8.2.34 are vulnerable. The fix is to upgrade to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For systems that cannot be immediately upgraded, applying virtual patching through a web application firewall or an intrusion prevention system may reduce risk, but it does not eliminate it.<\/p>\n
Administrators should also inspect servers for signs of compromise after applying the patch. Indicators of compromise may include unexpected files in web-accessible directories, unusual outbound network connections, unexplained processes, or changes to configuration files. Checking for web shells should be a priority. Tools and scanning scripts are available from security vendors and open-source communities.<\/p>\n
For shared hosting environments, the responsibility often lies with the hosting provider. Customers should confirm whether their provider has applied the PHP update. Providers that have not yet patched should be pressed for a timeline. In the interim, consider temporarily taking non-critical sites offline or switching to a patched alternative environment.<\/p>\n
Industry Response and Coordination<\/h2>\n
The coordinated disclosure process involved multiple organizations working to minimize the window of exposure. Wiz researchers credited OpenAI and Calif with helping to demonstrate the exploitability and to coordinate the patch verification. Censys set up a dedicated tracking site, php2shell.censys.com, to monitor internet-wide exposure. The SANS Internet Storm Center issued an Infocon Yellow alert, urging network defenders to prioritize patching. Cloudflare’s WAF rules were deployed within hours of the public disclosure.<\/p>\n
Ubuntu’s rapid release of updated PHP packages shows that major Linux distributions are moving quickly. However, for many organizations, especially those running custom applications or legacy systems, patching will not be straightforward. Testing compatibility with the new PHP versions before deploying to production is important to avoid breaking existing functionality. Given the severity of the threat, a risk-based decision to patch immediately even with minimal testing may be justified.<\/p>\n
OpenAI’s involvement in vulnerability research marks an evolving role for large-scale AI in cybersecurity. The company stated that frontier AI models substantially reduced the barrier to demonstrating exploitability, turning a decades-old flaw into a weaponizable exploit. This raises broader questions about the dual-use potential of advanced AI in security research. While AI can accelerate defense, it can also accelerate offense. The PHP vulnerabilities are a concrete example of this dynamic at work.<\/p>\n
The Road Ahead: Persistent Risk and Lessons Learned<\/h2>\n
The immediate crisis will likely subside over the next few days as large organizations and hosting providers apply patches. But the long tail of unpatched systems will remain a persistent risk. Just as with Log4Shell, threat actors will continue to scan for vulnerable servers for years. Organizations that do not have a robust vulnerability management program should expect to be targeted. Inventorying all PHP instances, establishing a patching cadence, and monitoring for exploitation are now operational necessities.<\/p>\n
The emergence of these vulnerabilities also highlights the fragility of the global web infrastructure. A single programming language used by the majority of websites can become a single point of failure. The fact that the vulnerabilities went undetected for a decade, and were only weaponized with the help of AI, underscores how quickly the cybersecurity landscape is changing. Defenders must adapt to a world where attackers can leverage advanced tools to turn dormant flaws into active threats.<\/p>\n
For website owners who have not yet patched, the message is clear: do not wait. The exploits are public. Attackers are actively scanning. Every hour of delay increases the probability of compromise. The internet cannot afford a repeat of the Log4Shell aftermath, where millions of servers remained vulnerable for months. This time, the stakes are even higher because PHP underpins so much of the web’s content layer. Patching now is the only reliable defense.<\/p>\n","protected":false},"excerpt":{"rendered":"
The scale of the crisis unfolding across the internet today is difficult to overstate. Two critical vulnerabilities in the PHP programming language have triggered widespread website outages, with government portals in Europe and elsewhere going dark, private-sector sites serving error pages, and security teams scrambling to apply emergency patches. An estimated 70 percent of websites […]<\/p>\n","protected":false},"author":7,"featured_media":101171,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/101166.png","fifu_image_alt":"Active PHP Exploits Trigger Mass Website Outages Today","footnotes":""},"categories":[40668],"tags":[],"class_list":["post-101166","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/101166.png","fifu_image_alt":"Active PHP Exploits Trigger Mass Website Outages Today","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/101166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=101166"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/101166\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/101171"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=101166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=101166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=101166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}