- PHP security team announced two critical vulnerabilities rated 9.2 on the CVSS v4.0 severity scale and scheduled a patch release for October 21, 2026, at 14:00 UTC.
- CERT-EU issued an advisory warning of unauthenticated remote code execution risks and urged immediate patching or taking affected sites offline.
- ACSC provided similar guidance, urging organizations to identify PHP systems and prepare to apply patches.
- Cloudflare CTO Dane Knecht reported early attacks emerging and stated that the company is updating its firewall rules as a stopgap measure.
- PHP confirmed the patch release is scheduled for 1400 GMT on Wednesday and urged users to upgrade as soon as the update is available.
- PHP's security team warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release.
- Web hosting provider GoDaddy stated that the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement, or full system compromise.
- Wordfence warned that all WordPress sites run on a PHP-installed server and advised site owners to ensure they know who is responsible for updating PHP on their sites.
- CERT-EU and ACSC indicated that all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.
PHP developers announced patches for two critical vulnerabilities rated 9.2 on the CVSS scale, warning of potential remote code execution risks.
The European Union Computer Emergency Response Team (CERT-EU) advised organizations unable to patch to take affected sites offline.29
"We are seeing early attacks emerging and are updating mitigations as new vectors show up," said Dane Knecht, CTO of Cloudflare, emphasizing the urgency of applying the patches as soon as they are available.
The vulnerabilities could allow attackers to execute code on servers, leading to data theft or system compromise, according to GoDaddy.7
The Australian Cyber Security Centre (ACSC) echoed these concerns, urging organizations to identify PHP systems and monitor for malicious activity, although they noted no active exploitation was currently detected.3
PHP's security team plans to release full technical details alongside the patches, scheduled for October 21, 2026, at 14:00 UTC. They warned that if evidence of active attacks emerges, updates may be released sooner.16
CERT-EU recommends organizations prepare for immediate patching and isolate vulnerable applications if necessary.
"ACSC is currently not aware of active exploitation related to these vulnerabilities," the agency stated, but the potential risks necessitate prompt action from website owners and hosting providers.
“CERT-EU warns the 9.2 rating indicates unauthenticated remote code execution, allowing attackers to run malicious code without logging in. Cloudflare's CTO reports early attacks emerging, and the company is updating firewall rules as a stopgap until the official fix arrives.”
CyberSecurityNews
