Critical PHP zero-day triggers global outages and urgent patching

Web infrastructure is facing a severe disruption today as two critical zero-day vulnerabilities in PHP are being actively exploited in the wild. The PHP development team released emergency patches on October 21, 2026, but the scale of the issue has already caused government websites in Europe and elsewhere to go offline. With nearly 70 percent of websites relying on this core software, security experts warn that attackers can seize full control of unpatched servers.

What happened

The crisis centers on two specific flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which allow remote code execution. This means an attacker can run arbitrary commands on a vulnerable server, effectively taking ownership of the machine. The PHP project issued emergency updates to fix these bugs, but the window for exploitation opened before many organizations could apply the patches. Reuters reported that multiple government portals went dark today as administrators scrambled to mitigate the threat or take systems offline to prevent compromise.

Cloudflare, a major internet infrastructure provider, detected active exploitation attempts shortly after the disclosure. At 3:02 am UTC, the company deployed web application firewall rules to block traffic targeting these specific vulnerabilities. These attacks aim to cause denial of service conditions, execute malicious code remotely, and expose sensitive data. The speed of the response from infrastructure providers highlights the immediate danger posed by these flaws, which are already being used in coordinated attacks rather than just theoretical proof-of-concepts.

The scope of the vulnerability is massive. Censys, a firm that maps internet-connected devices, identified approximately 2.58 million internet-facing hosts and 54.9 million web properties running PHP. Because PHP powers popular content management systems like WordPress, Drupal, Joomla, and Magento, the impact ripples through countless independent websites and enterprise applications. OpenAI, which participated in the research and outreach effort, described the situation as one of the most impactful security issues in recent memory due to the sheer prevalence of the affected software.

How it works

These vulnerabilities are not new code errors but deep-seated flaws that have existed in PHP for decades. According to researchers at Wiz, every PHP version released in the last ten years is affected by at least one of these two bugs. The reason they remained undiscovered for so long is the extreme complexity required to exploit them. Chaining the necessary steps to achieve remote code execution was previously at the edge of what human researchers could practically achieve without immense time and resources.

The breakthrough came with the assistance of frontier AI models. Wiz researchers noted that artificial intelligence substantially reduced the barrier to finding the exploit chain, turning a longstanding, dormant flaw into an immediate weapon. This shift demonstrates how AI is changing the vulnerability landscape, allowing attackers or researchers to uncover complex bug chains that were previously considered too difficult to leverage. Once exploited, the likely outcome is the installation of web shells, which are backdoors that give attackers a persistent, web-based panel to control infected sites remotely.

Key details

• The vulnerabilities affect all web servers running PHP 5.4 or later.
• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Approximately 54.9 million web properties and 2.58 million hosts are exposed.
• Active exploits are already in the wild, with Cloudflare blocking attacks since 3:02 am UTC.
• Government websites in Europe have gone offline due to the disclosures and subsequent chaos.
• Wiz researchers compare the severity and reach of this event to the Log4Shell crisis of 2021.

Why it matters

For software engineers and IT leads, this event underscores the fragility of dependent ecosystems. PHP is deeply embedded in clouds, hosting providers, and content-delivery networks. A vulnerability in such a core layer does not just affect a single application; it compromises the entire stack beneath it. The comparison to Log4Shell is apt because, like Java’s logging framework, PHP is often a transitive dependency. Developers may not even know they are running vulnerable versions if they rely on managed hosting or older container images that have not been updated.

The involvement of AI in discovering these exploits signals a new era of security risk. Flaws that were once safe due to their complexity are now viable targets. This means that legacy systems, which organizations often leave unpatched because they assume no one can break them, are now high-priority targets. The struggle to patch these vulnerabilities will likely persist for weeks or months, as teams navigate the complexities of updating production environments without breaking existing functionality. The coordination required across the ecosystem, from the PHP team to cloud providers, shows that no single entity can solve this alone.

What you can do

• Immediately check your server’s PHP version and upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
• If you use managed hosting, contact your provider to confirm when their patched images will be available.
• Review web application firewall logs for unusual POST requests or signs of web shell installation.
• Update underlying operating system packages, such as the new PHP packages released by Ubuntu.
• Audit any custom PHP applications for signs of unauthorized file creation or modification.
• Monitor the SANS Internet Storm Center for ongoing updates and emerging mitigation strategies.