Expect to see a number of websites displaying error pages today: Nearly 70% of websites need to update their core software to fix two vulnerabilities that allow an attacker to take full control of affected servers. Experts say that there are working exploits for the flaws and that these critical bugs are already being exploited in the wild.
Image: Shutterstock.com, Sashkin.
The defects in question are present in PHPthe programming language that powers sites running on a large number of web publishing systems, including Drupal, Magento, Joomla And WordPress. Earlier today, PHP released an emergency security update to fix two critical bugs that could allow an attacker to execute any code they want on a vulnerable server.
Reuters reports that government websites in Europe and elsewhere were taken offline today after PHP vulnerabilities were disclosed. Cloudflare said it had already detected some exploitation of the flaw and implemented web application firewall rules at 3:02 a.m. (UTC) to protect websites from attack traffic seeking to exploit the bugs, which could lead to denial of service, remote code execution and data exposure.
OpenAIwho was involved in researching and raising awareness about the vulnerabilities, said: “Given the severity of these flaws and the widespread use of PHP, we consider this to be one of the most significant security issues in recent memory. »
Censysa company that tracks the technology used by Internet hosts, said a recent analysis identified approximately 2.58 million hosts connected to the Internet and 54.9 million web properties running PHP.
Security experts at Ace said that every version of PHP released over the last decade is affected by at least one of these vulnerabilities (full disclosure: Wiz is an advertiser on this blog).
“These findings are among the most serious vulnerabilities discovered in PHP, and arguably in the history of software,” reads a blog post published today by a team of researchers from Wiz, one of several organizations credited with discovering these vulnerabilities. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the limit of what human researchers could practically achieve. Frontier AI models significantly reduced this barrier, turning a long-standing flaw into an exploit.”
Wiz researchers say it is likely that PHP vulnerabilities will be exploited en masse to install web-based backdoors or “web shells”, which provide attackers with a web panel allowing them to remotely control infected sites. Wiz said that before the PHP bugs were publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the scope of the problem and coordinate verification and release of fixes.
PHP zero day vulnerabilities are tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later. Bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36And 8.2.35.
According to Wiz, PHP is so deeply integrated into many web applications that we will likely see organizations struggling to patch these vulnerabilities for some time to come, comparing this pair of PHP vulnerabilities with the Log4Shell weakness that emerged in 2021 – a widespread and serious security flaw in Log4j, a popular Java logging framework.
“A vulnerability in the PHP core extends well beyond a single application,” Wiz researchers wrote. “PHP runs across clouds, hosting providers, content delivery networks, and millions of independently managed servers. Reducing exposure before technical details became public required coordinated work across this entire ecosystem.”
THE SANS Internet Storm Center monitors major software platforms that offer updates to address these PHP vulnerabilities. For example, Ubuntu just released updated PHP packages. For an in-depth technical analysis of these vulnerabilities that tells the timeline of the discovery of these bugs in comic book style, check out this article from Californiaanother technology company recognized for discovering PHP vulnerabilities.
This is a rapidly evolving story. Updates will be noted here with timestamps.
Update, 2:30 p.m. ET: Add figures from Censys and a link to the Calif article.
Gn world
