Urgent PHP Security Alerts: Critical Flaws Uncovered Prompt Emergency Patches and Warnings"

10/22/2026

Updated on Thursday, Oct. 22 at 11:15 a.m. ET — The PHP security issues known as PHP2Shell sent the cybersecurity world into a frenzy yesterday, and now we have some data on the...

10/22/2026

Google Cloud is not affected, but customers running PHP applications on the platform may be vulnerable.

10/22/2026

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two AI-found flaws that let attackers run code on web servers without logging in. Update now.

10/22/2026

PHP has released patches for two critical remote code execution (RCE) vulnerabilities and "strongly encouraged" all users to apply them as soon as possible, as hackers are starting to abuse the...

10/22/2026

Website hosts need updated PHP software to fix two memory flaws that can let attackers run server code without logging in.

10/22/2026

The PHP project moved its security release forward after an accidental proof-of-concept leak exposed critical vulnerabilities that went unfixed for years due to organizational failures.

10/21/2026

Google Cloud has issued urgent patch guidance for critical RCE vulnerabilities in PHP. If you run PHP on GCP, upgrade to version 8.2 or newer and redeploy your apps immediately to stay protected.

10/21/2026

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36...

10/21/2026

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official...

10/21/2026

PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all...

10/21/2026

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that...

10/22/2026

CERT-In has rated two new PHP flaws critical as government sites and parts of Wikipedia go offline worldwide. Here is what PHP2Shell is and what it means for you.

10/22/2026

Two critical PHP vulnerabilities could allow attackers to compromise web servers without authentication, prompting emergency security updates and warnings from cybersecurity authorities, including...

10/22/2026

The PHP2Shell vulnerabilities could allow hackers to execute code remotely without authentication, prompting cybersecurity agencies to urge organisations to patch affected systems or take them...

10/22/2026

‘PHP2Shell’ remote code execution vulnerability patched, but organizations need to identify vulnerable systems and update to the latest PHP version, agencies warn

10/22/2026

The issue, known as PHP2Shell, led to emergency patches for two vulnerabilities that could enable remote code execution.

10/21/2026

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.

10/21/2026

Website owners are bracing for an urgent security update after a serious warning, with the PHP team preparing an emergency response, as the vulnerabilities impact around 70% of the web.

10/21/2026

The PHP security team says it has scheduled patches for Wednesday, October 21, at 14:00 UTC.

10/21/2026

The PHP Security Team has released updates that every website owner should know about.

10/21/2026

Millions of websites could face serious security risks after details of two critical PHP vulnerabilities leaked ahead of their planned disclosure, prompting an emergency patch announcement and...

10/21/2026

Gear up to patch sharply today

10/21/2026

The two PHP vulnerabilities carry a CVSS score of 9.2