Critical PHP Flaws Trigger Global Site Outages as Exploits Hit Wild
Nearly 70 percent of websites face immediate risk from two critical PHP vulnerabilities that allow remote code execution and server takeover.
Key points
- PHP released an emergency update to fix two critical bugs enabling full server control.
- Wiz researchers state every PHP version from the last decade is affected by at least one flaw.
- Cloudflare detected active exploitation and deployed firewall rules to block attack traffic.
PHP released an emergency security update today to address two critical vulnerabilities that allow attackers to execute arbitrary code on vulnerable servers. According to Krebs on Security, nearly 70 percent of websites require this core software update to prevent full server compromise. Experts confirm that working exploits for these flaws are already circulating and being used in active attacks against live infrastructure.
The vulnerabilities affect the PHP programming language, which powers major web publishing systems including Drupal, Magento, Joomla, and WordPress. Reuters reported that government websites in Europe and other regions went offline shortly after the flaws were disclosed. Cloudflare stated it detected exploitation attempts and implemented web application firewall rules at 3:02 am UTC to protect sites from traffic seeking to exploit the bugs.
Context and Background
Security researchers at Wiz identified that every PHP version released in the past decade is affected by at least one of these vulnerabilities. A blog post from the Wiz team described the findings as among the most severe in software history. The researchers noted that while the underlying flaws had existed for decades, demonstrating their exploitability previously required an exceptionally complex chain of steps that was nearly impossible for human researchers to achieve practically.
OpenAI, which participated in the vulnerability research and outreach process, characterized the issue as one of the most impactful security events in recent memory due to PHP’s widespread adoption. The Wiz team explained that frontier AI models significantly reduced the barrier to exploitation, transforming long-standing theoretical flaws into practical, weaponized exploits that attackers can now deploy with relative ease.
Who Is Affected
The impact extends beyond individual websites to include large-scale infrastructure providers and government entities. Cloudflare indicated that the bugs could cause denial of service conditions, remote code execution, and data exposure. Security experts at Wiz warned that mass exploitation is likely to result in the installation of web-based backdoors or web shells. These tools provide attackers with a remote control panel to manage infected sites and maintain persistent access to compromised servers.
What to do and how to stay safe: PHP
- Verify if your server runs any PHP version released in the last decade, as all are potentially affected.
- Monitor web server logs for unusual activity or signs of web shell installation following the update.
- Apply the emergency PHP security update immediately to patch the remote code execution flaws.
- Review firewall rules to ensure they block known exploit traffic patterns associated with these bugs.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these vulnerabilities?
According to Wiz researchers, every PHP version released in the last decade is affected by at least one of the vulnerabilities.
Are these vulnerabilities currently being exploited?
Yes, experts state that working exploits exist and that the bugs are already being exploited in the wild.
What is the potential impact of these flaws?
The flaws can allow an attacker to execute code of their choosing, seize full control of servers, and cause denial of service.
