A developer released a WordPress plugin that replaces visible CAPTCHAs with a silent proof-of-work challenge, requiring visitors' browsers to solve a small cryptographic puzzle before submitting forms. The plugin claims to work across logins, registrations, comments, WooCommerce checkout and major form builders like Contact Form 7, WPForms and Gravity Forms by recognizing submission signatures rather than relying on per-plugin integrations, and it offers a manual mode to learn custom or unsupported forms.
Security researchers disclosed two vulnerabilities affecting the PHP programming language, which is used by an estimated 70 percent of websites including Wikipedia, WordPress and Drupal. The flaws exist in every version of PHP released over roughly the past 20 years, and sites like DeviantArt and 4Chan were temporarily taken offline after disclosure.
The UK government is assessing whether its online services are exposed to newly disclosed vulnerabilities in PHP, the programming language running a large share of websites worldwide, including platforms like Wikipedia and WordPress. The National Cyber Security Centre, along with counterparts in the EU and Australia, has urged organisations to apply fixes immediately or take affected systems offline, while Amazon reported attempted attacks on its systems before the public warning was even issued.
The PHP Foundation issued an emergency security patch for two critical vulnerabilities in its widely used web programming language, prompting the Netherlands, Denmark, France and Finland to take some government websites offline as a precaution. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, confirmed Canada also took sites down temporarily and urged PHP users to update immediately. The flaws, present in PHP versions released over roughly 20 years, were reportedly discovered using AI tools employed by cybersecurity firms.
Automattic has started cutting staff over the past week, hitting its communications team, social media team, WordPress.com, and its VIP enterprise business, with insiders telling TechCrunch more cuts are expected. The layoffs follow a chaotic period at the company that included a failed board attempt to oust CEO Matt Mullenweg in September, a complete board turnover, and departures of its CFO, interim CFO and Chief Legal Officer.
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
PHP issued an emergency security update fixing two critical vulnerabilities that let attackers run arbitrary code on vulnerable servers, affecting software behind Drupal, Magento, Joomla and WordPress. Researchers at Wiz, who helped discover the bugs along with OpenAI, say every PHP version released in the past decade contains at least one flaw, and Cloudflare and Reuters reported active exploitation and government site outages following disclosure.
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
The UK's National Cyber Security Centre, along with EU and Australian counterparts, has told organisations using PHP to install a critical update released by the PHP Foundation on Wednesday. Two vulnerabilities were identified that could allow unauthenticated remote code execution, potentially letting attackers install malware or disable websites. Officials say affected versions may stretch back as far as PHP 5, released in 2004.
The PHP Foundation is rolling out patches for two vulnerabilities rated 9.2 out of 10 in severity, following reports of a tool called PHP2Shell that can run malicious code on servers using WordPress, Drupal, MediaWiki and other PHP-based platforms, reportedly affecting every PHP version since 2004. Separately, India-based certificate authority eMudhra disclosed that eight of its intermediate CA certificates—trusted by Mozilla, Microsoft, Apple and Chrome—have weak private keys that could let attackers forge credentials.
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
GoKawiil