TWO critical PHP zero-days are driving widespread disruption as experts warn that nearly 70% of websites require core software updates to fix the flaws. The vulnerabilities affect PHP itself and enable remote code execution, potentially allowing attackers to seize full control of affected servers. There are reports of exploits already being active in the wild, with government sites in Europe offline and Cloudflare saying it has started blocking attack traffic with WAF rules after the flaws were disclosed.
The issues are described as severe enough to cause denial of service, remote code execution and data exposure, and industry observers warn that the impact could be far-reaching given PHP’s ubiquity across Drupal, Magento, Joomla and WordPress ecosystems.
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and affect all web servers running PHP 5.4 or later. Patches are released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz researchers have warned that virtually every PHP version released in the last decade is affected by at least one of the flaws and anticipate mass exploitation to install web shells or backdoors, enabling ongoing remote control of compromised sites.
OpenAI participated in the coordinated disclosure, emphasising the severity and impact. UK users should note that Ubuntu and other platforms are releasing updated PHP packages as the community coordinates patch verification; SANS ISC is monitoring the situation as a fast-moving story with updates expected.