Key points
- PHP released emergency updates to fix two critical bugs enabling remote code execution.
- Wiz researchers state every PHP version from the last decade is affected by at least one flaw.
- Cloudflare detected exploitation and deployed web application firewall rules to mitigate attack traffic.
Security operations teams are witnessing widespread website outages and "404" errors as attackers exploit critical vulnerabilities in PHP. These flaws allow adversaries to seize full control over affected servers, prompting urgent updates for nearly 70 percent of all websites. The immediate impact includes significant service disruptions across government and commercial sites.
The vulnerabilities enable remote code execution, denial of service conditions, and potential data exposure. Experts confirm that working exploits are active and being used in the wild. The severity stems from the ability of attackers to execute arbitrary code on vulnerable infrastructure, effectively compromising the entire server environment hosting these applications.
Context and Background
Researchers at Wiz described the issues as among the most severe in software history. They noted that while the underlying flaws existed for decades, demonstrating exploitability previously required complex steps beyond practical human reach. Frontier AI models reduced this barrier, turning longstanding theoretical weaknesses into actionable exploits for adversaries.
Who Is Affected
The bugs exist in PHP, the programming language powering major web publishing systems including Drupal, Magento, Joomla, and WordPress. According to Wiz, every PHP version released in the last decade contains at least one of these vulnerabilities. OpenAI, involved in the research, called it one of the most impactful security issues in recent memory due to PHP’s widespread adoption.
Next steps
PHP released an emergency security update to address the two critical bugs. Organizations must apply this update immediately to mitigate the risk of remote code execution. Cloudflare implemented specific web application firewall rules to protect managed websites from attack traffic seeking to exploit these specific bugs, providing a temporary layer of defense for subscribers.
Signals worth monitoring
Teams should prioritize reviewing web server access logs for unusual request patterns or spikes in error codes. Look for signs of unauthorized file creation or modifications in web directories, which often indicate web shell installation. Monitor for outbound connections from web servers to unknown external IP addresses. Verify that automated backup processes are functioning correctly to ensure rapid recovery capabilities in case of compromise.
What to do and how to stay safe: PHP
- Apply the latest PHP emergency security update to all production and staging environments immediately.
- Review web server logs for suspicious activity indicative of exploitation or unauthorized code execution.
- Deploy or update web application firewall rules to block known exploit patterns targeting these vulnerabilities.
- Isolate any compromised servers from the network to prevent lateral movement while conducting forensic analysis.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are vulnerable to these critical flaws?
According to Wiz researchers, every PHP version released in the last decade is affected by at least one of the vulnerabilities.
Are these exploits currently being used in attacks?
Yes, experts state that working exploits exist and the critical bugs are already being exploited in the wild.
What is the potential impact of these vulnerabilities?
The flaws can cause denial of service conditions, allow remote code execution, and lead to data exposure on affected servers.
