Critical PHP Vulnerability Threatens 40% of the Web

Why two bugs threaten over 40 percent of the internet

PHP underpins vast segments of web infrastructure, meaning an exploit in its core execution runtime exposes everything built on top of it.

The alert issued by PHP maintainers carries an alarming severity rating of 9.2 out of 10. According to cybersecurity firm watchTowr, the flaws enable remote code execution (RCE) on affected hosts, allowing unauthorized attackers to execute arbitrary system commands, steal server data, or compromise databases completely.

Crucially, the flaw reportedly spans every release from PHP 5 onward. Because content management engines like WordPress rely entirely on PHP underneath, plugin vendor Wordfence warned that every WordPress installation is structurally vulnerable. With WordPress running on over 40 percent of all websites, the blast radius is massive. Security researchers estimate that more than 1.3 million directly exposed internet hosts require immediate remediation.

Early attacks emerge as agencies advise taking systems offline

Defenders do not have the luxury of waiting. Researchers at e-commerce security firm Sansec warned that automated mass exploitation attempts could begin within 15 minutes of patch releases and vulnerability disclosures. Cloudflare chief technology officer Dane Knecht confirmed that the platform had already observed early attacks emerging in the wild, forcing the delivery network to deploy interim firewall mitigation rules.

Unlike standard CMS plugin patches, updating the PHP runtime cannot happen automatically through a WordPress dashboard. Administrators must update the packages directly through their operating system repositories, container images, or hosting control panels. That creates dangerous lag time, especially when rapid reconnaissance tools and rogue automated systems can scan entire address spaces in minutes.

The urgency prompted both the European Union Computer Emergency Response Team (CERT-EU) and the UK National Cyber Security Centre (NCSC) to issue advisories urging organisations to disconnect exposed services if they cannot patch right away. Project teams are already taking drastic steps: privacy-focused mobile OS maker GrapheneOS preemptively pulled its community discussion forum offline to avoid falling victim to emerging proof-of-concept exploits.

What system administrators need to do

The official security patches roll out today at 10:00 AM ET, though developers noted releases could drop earlier if exploit code surfaces widely. System administrators across the US, UK, and Europe should check their server environments immediately, ensure their package managers point to official security channels, and verify who manages the root PHP environment on their hosting stacks.

As PHP developer Gina Peter Banyard noted, there is no configuration workaround: applying the patch is the only mitigation. If your infrastructure team cannot apply the update the moment packages become available, severing public access or temporarily isolating the server remains the safest course of action.