Critical PHP vulnerabilities put websites at takeover risk
Critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 could allow attackers to take full control of affected web servers. PHP is a programming language used to build and run websites, including sites based on WordPress, Drupal, Joomla and Magento. PHP issued emergency security updates on October 21, 2026, as KrebsOnSecurity reported that nearly 70 percent of websites need to update their core software. Experts cited by the publication said working exploits, meaning practical attack methods, already exist and the flaws are being exploited in the wild against real systems.
Both vulnerabilities can let an attacker execute code of their choice on a vulnerable server, the computer system that delivers a website to visitors. That capability can provide broad control over the affected system rather than access to only one page or feature. Reuters reported that government websites in Europe and elsewhere went offline after the vulnerabilities were disclosed, indicating that the disruption was already visible beyond security research environments.
Cloudflare said it had detected exploitation and introduced web application firewall rules at 3:02 am UTC. A web application firewall inspects and filters requests sent to websites. According to Cloudflare, attacks targeting the PHP flaws could cause denial of service, which makes a website unavailable, remote code execution, which lets an attacker run commands from another location, and data exposure. Firewall rules can filter identified attack traffic, but operators still need to install the corrected PHP software.
The report describes CVE-2026-109618 and CVE-2026-109619 as zero-day vulnerabilities, flaws that can be exploited before a fix is publicly available. They affect web servers running PHP 5.4 or later. Wiz said every PHP version released during the past decade is affected by at least one of the two bugs. PHP has fixed the flaws in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The SANS Internet Storm Center is monitoring major software platforms as they release related updates, and Ubuntu has already issued updated PHP packages.
The potential exposure is unusually large. Censys, which tracks software visible on Internet systems, said a recent scan found about 2.58 million Internet-facing hosts, meaning systems reachable directly over the Internet, and 54.9 million web properties running PHP. Those measurements show the scale of PHP deployment, although the figures describe systems using PHP rather than a confirmed count of successfully attacked websites.
Wiz was one of several organisations credited with finding the vulnerabilities. Before public disclosure, Wiz said it worked with the PHP team, Calif and OpenAI to measure the scope, verify patches and coordinate disclosure. OpenAI took part in the research and outreach and described the flaws as one of the most consequential security issues in recent memory because of their severity and PHP's extensive use.
According to Wiz, the underlying weaknesses had existed for decades, but proving that they could be exploited required an exceptionally complicated sequence of steps near the practical limits of human research. Wiz said frontier AI models, highly capable artificial intelligence systems, substantially lowered that obstacle and helped turn a longstanding weakness into a working exploit. This detail matters because it suggests that a flaw can remain buried in mature software for years while advances in research tools make a practical attack easier to develop.
Wiz expects attackers to attempt mass exploitation and install backdoors or web shells. A web shell is a hidden web-based control panel that gives an attacker remote access to an infected site. The researchers compared the likely patching challenge with Log4Shell, the severe vulnerability disclosed in 2021 in Log4j, a Java component used to record software activity. PHP is embedded across cloud platforms, hosting companies, content-delivery networks and independently managed servers, so reducing exposure requires action throughout that ecosystem rather than an update to a single application. For WordPress owners reviewing this risk, AEU Hosting provides managed WordPress hosting secured end to end.
Website owners should ask their hosting provider which PHP build is actively serving their site and whether it has been moved to one of the fixed releases. Updating WordPress, Drupal, Joomla or Magento alone should not be mistaken for replacing the vulnerable PHP software beneath them. Censys has also created php2shell.censys.com to track the vulnerabilities, while Calif has published a technical account of the discovery timeline in a comic-book style. With exploitation already reported, applying the appropriate PHP security update is the central step for reducing exposure and avoiding preventable compromise or outages.