Critical PHP Vulnerabilities Lead to Immediate Security Measures
Two critical PHP vulnerabilities disclosed on October 21, 2026, allow remote code execution. Exploitation has been confirmed, prompting emergency updates and service shutdowns in various sectors.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Two critical PHP vulnerabilities were disclosed, allowing remote code execution.
Who is affected
PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Exploited
Early attacks exploiting the vulnerabilities have already been reported.
What to do
Organizations are urged to apply patches immediately or take affected services offline.
Two critical vulnerabilities in PHP were disclosed on October 21, 2026. These vulnerabilities have been rated 9.2 out of 10 on the CVSS v4.0 severity scale, indicating a high level of severity.
The vulnerabilities allow unauthenticated remote code execution, posing significant risks to systems using PHP. PHP is widely used, powering approximately 70% of websites whose programming language can be identified.
The PHP team has released corrected versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address these vulnerabilities. Organizations are urged to apply these patches immediately or take affected services offline to prevent exploitation.
Early attacks exploiting these vulnerabilities have already been reported. Cloudflare has noted a rapid increase in attempted exploitation following the public disclosure of the vulnerabilities.
Colombia's Cyber Emergency Response Team identified 8,699 internet-facing services using PHP. Emergency updates and service shutdowns have occurred across various sectors, including government websites in Europe and Colombia.
Sources
Thedailystar: What is PHP and why did it take government websites offline?
Ifamagazine: Cyber expert warns businesses to act now over critical PHP security flaws or risk further attacks
