Critical PHP Flaws Put Millions of Websites at Risk, and Patching Is Urgent

Wiz Research has uncovered multiple critical vulnerabilities in core PHP, the scripting language that powers around 70% of websites worldwide, including WordPress, Joomla, Drupal and MediaWiki. The flaws sit in PHP itself, not in the applications built on top of it, so a vulnerable website is exposed regardless of which application it runs. They were grouped under two CVEs, with severity reaching CVSS 9.2.

The issues include memory disclosure and unauthenticated remote code execution. Attackers could take control of affected servers, steal data and deface websites. Leaked memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or to the server. Every PHP version released in the last decade is affected by at least one flaw, going back to version 5.4. Some can be exploited remotely and fairly easily.

Wiz says the underlying weaknesses had existed for decades, but proving they could be exploited required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially lowered that barrier. PHP released a patch for the memory-safety vulnerabilities in its core engine on October 21, 2026, following a cross-industry effort to find variants, deploy detections and mitigations, and verify the fix before coordinated disclosure. Wiz strongly advises immediate patching.