Critical PHP Security Flaws Trigger Emergency Patches and Warnings for Millions of Websites

10/22/2026

The PHP project moved its security release forward after an accidental proof-of-concept leak exposed critical vulnerabilities that went unfixed for years due to organizational failures.

10/21/2026

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that...

10/21/2026

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.

10/21/2026

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official...

10/21/2026

Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that...

10/21/2026

The two PHP vulnerabilities carry a CVSS score of 9.2

10/21/2026

The PHP security team says it has scheduled patches for Wednesday, October 21, at 14:00 UTC.

10/21/2026

The PHP Security Team has released updates that every website owner should know about.

10/21/2026

Gear up to patch sharply today

10/21/2026

Millions of websites could face serious security risks after details of two critical PHP vulnerabilities leaked ahead of their planned disclosure, prompting an emergency patch announcement and...

10/21/2026

A severe vulnerability has been found in key web technology PHP, forcing just about everybody to patch websites, and fast. Expect outages.Websites may go down for a few days because of a nasty PHP...

10/22/2026

Critical PHP2Shell flaws could enable remote code execution and memory leaks, prompting security patches and industry-wide action.

10/22/2026

Website hosts need updated PHP software to fix two memory flaws that can let attackers run server code without logging in.

10/22/2026

The PHP2Shell vulnerabilities could allow hackers to execute code remotely without authentication, prompting cybersecurity agencies to urge organisations to patch affected systems or take them...

10/22/2026

The issue, known as PHP2Shell, led to emergency patches for two vulnerabilities that could enable remote code execution.

10/22/2026

‘PHP2Shell’ remote code execution vulnerability patched, but organizations need to identify vulnerable systems and update to the latest PHP version, agencies warn

10/22/2026

October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried...

10/22/2026

Updated on Thursday, Oct. 22 at 12:25 p.m. ET — The PHP security issues known as PHP2Shell sent the cybersecurity world into a frenzy yesterday, and now we have some data on the...

10/21/2026

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36...

10/22/2026

A rush to update websites and protect against vulnerabilities in a widely used programming language continued into its second day, with researchers warning that hackers have attempted to exploit...

10/22/2026

There were few, if any, reports of widespread damage by hackers exploiting PHP flaws, experts said, one day after officials warned of severe vulnerabilities.

10/22/2026

Google Cloud is not affected, but customers running PHP applications on the platform may be vulnerable.

10/21/2026

One exploitation attempt was sourced to an IP address based in China, says security provider VulnCheck. The flaw affects PHP, a scripting language used by an estimated 70% of websites.

10/22/2026

The NSA (National Security Agency/Central Security Service) just dropped an urgent cybersecurity warning- so in case someone is running PHP, the vulnerabilities, known as ‘PHP2Shell’, could let...

10/22/2026

Two critical PHP vulnerabilities could allow attackers to compromise web servers without authentication, prompting emergency security updates and warnings from cybersecurity authorities, including...

10/22/2026

CERT-In has rated two new PHP flaws critical as government sites and parts of Wikipedia go offline worldwide. Here is what PHP2Shell is and what it means for you.