Critical PHP Flaws Threaten 70% of Websites

Introduction

Organizations worldwide are facing widespread website outages and potential security breaches following the disclosure of two critical vulnerabilities in PHP, the programming language that underpins a majority of web applications. These flaws allow attackers to execute arbitrary code on vulnerable servers, effectively granting them full control. With working exploits already circulating and active exploitation confirmed, the urgency to patch cannot be overstated.

Critical Vulnerabilities in PHP

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect all PHP versions from 5.4 onwards. They were addressed in emergency updates released today across multiple PHP branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. According to researchers at Wiz, these are among the most severe PHP vulnerabilities ever discovered, with exploitation requiring a highly complex chain of steps that was significantly simplified through the use of advanced AI models during the research phase.

Censys, a platform that monitors internet-connected hosts, recently identified approximately 2.58 million internet-facing hosts and 54.9 million web properties running PHP, underscoring the vast attack surface. The vulnerabilities impact a wide range of content management systems and frameworks, including Drupal, Magento, Joomla, and WordPress.

Cloudflare reported detecting early exploitation attempts and deployed web application firewall (WAF) rules to mitigate attack traffic. Government websites in Europe were among the first to go offline following the disclosure, highlighting the immediate real-world impact.

Active Exploitation and Real-World Impact

Security firms have confirmed that these vulnerabilities are not theoretical—they are being actively exploited in the wild. Researchers at Wiz noted that attackers are likely leveraging these flaws to deploy web shells, which provide persistent remote access to compromised servers. Such access can facilitate data theft, service disruption, and further lateral movement within affected networks.

The scale of potential impact is immense. PHP's deep integration across cloud infrastructures, hosting providers, content delivery networks, and independently managed servers means that a single unpatched instance could serve as an entry point for broader attacks. OpenAI, which contributed to the vulnerability research, described these flaws as one of the most impactful security issues in recent memory due to PHP’s pervasive use.

What Organizations Should Do Now

IT and security teams must act swiftly to mitigate risks posed by these vulnerabilities. The primary step is to update PHP installations to the latest patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the active branch. Organizations running legacy systems should prioritize upgrading unsupported versions, as they remain susceptible to exploitation.

For environments where immediate patching is not feasible, deploying WAF rules—as implemented by Cloudflare—can offer temporary protection against known exploit patterns. However, this should be viewed as a stopgap measure, not a long-term solution. Network monitoring tools should be configured to detect unusual outbound traffic or unauthorized access attempts that may indicate successful exploitation.

Additionally, organizations should audit their web applications for signs of compromise, particularly any unauthorized scripts or changes to configuration files. Regular vulnerability scanning and maintaining an updated inventory of PHP-based applications will also help reduce exposure in future incidents.

Conclusion

The disclosure of CVE-2026-109618 and CVE-2026-109619 serves as a stark reminder of the systemic risks posed by vulnerabilities in foundational software components. With active exploitation already underway and a significant portion of the web at risk, swift action is critical. Organizations must not only apply patches immediately but also reassess their vulnerability management and incident response frameworks. In an environment where AI is accelerating both discovery and exploitation, staying ahead requires intelligent automation and robust cloud security architectures. Grivyonx Technologies supports enterprises in building such defenses through its AI-powered security automation and DevSecOps solutions.