A new critical Internet security vulnerability has been announced, and it’s really, really bad.
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.
The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests” going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted, though, that some PHP distributions and third-party vendors still produce legacy fixes. The caveat is significant because ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure.
“There are no complete mitigations, updating is the only safe choice,” the PHP Foundation wrote in its advisories. Security experts warn of the potential dire consequences of overlooking unpatched systems.
“This is not a drill,” says Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London. Since its development in the 1990s, PHP has evolved into an essential scripting language for web development and is used across vast swaths of the internet in websites and software. Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe’s Magento are built on PHP.
You may have noticed that BattleSwarm is built on WordPress.
Olejnik likens the widespread use of the programming language to critical infrastructure.
“The impact is enormous,” he says of PHP’s security flaws, adding that millions of systems could be impacted. “Especially if attackers would turn to exploiting these vulnerabilities fast. Worst case is wormable malware affecting big chunks of the internet.”
The overriding fear for security teams and developers is that malicious hackers could quickly jump upon the vulnerabilities and begin exploiting deployments before they are fixed. Internet infrastructure company Cloudflare reported it was “seeing early attacks emerging” before the PHP Foundation had detailed the vulnerabilities and released fixes. “We expect mass attacks to start within 15 minutes of the release,” security firm Sansec wrote ahead of the fixes, which were released just before 10 am ET on Wednesday.
“Most of the web runs on PHP and this bug is in a file upload interface that’s like a front door with no lock,” says longtime security and compliance consultant Davi Ottenheimer. “An attacker does not need to know which site they are hitting or even the actual software it runs. They send one crafted upload to any server they can find, and that is the entire attack.”
This is a huge, huge issue because PHP is everywhere. A vast number of websites use a LAMP stack (Linux, Apache, MySQL, and PHP), and PHP is in all of them. This is worse than the log4j vulnerability (which was bad enough), since in a pinch you can live without logging for a while. Remove PHP from your web server, and just about everything breaks. In theory, you could still serve up static web pages, but I’m betting most sites have PHP involved in that task as well, and anything serving up dynamic content (database call, stock prices, etc.) on a LAMP setup is going to break.
What does the actual PHP vulnerability note say? “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
That’s really, really, really bad.
Brian Krebs has a report that covers some of the things already breaking.
Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed. Cloudflare said it has already detected some exploitation of the flaw, and that at 3:02 am (UTC) it implemented web application firewall rules to protect websites from attack traffic seeking to exploit the bugs, which could cause a denial of service condition, remote code execution, and data exposure.
OpenAI, which was involved in the vulnerability research and outreach, said “given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”
Censys, a company that tracks the technology used by Internet hosts, said a recent scan identified approximately 2.58 million Internet facing hosts and 54.9 million web properties running PHP.
Security experts at Wiz said every PHP version released in the last decade is affected by at least one of these vulnerabilities [full disclosure: Wiz is an advertiser on this blog].
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” reads a blog post published today by a team of researchers at Wiz, which was one of several organizations credited with discovering the vulnerabilities. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Snip.
The bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Folks, this is a bad one. If you run any sort of website, you need to get this one updated ASAP.