GoKawiilPHP developers rush patch for two critical remote code execution flaws
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
GoKawiil's interpretation of the reporting above, not reported fact.
Security firm watchTowr says the flaws allow attackers to execute arbitrary code on servers, potentially letting them deface sites or steal data, and one researcher estimates over 1.3 million hosts could be exposed. Wordfence warns the fix requires manual installation rather than automatic updates, which could slow remediation across the millions of WordPress sites that rely on PHP, a platform reported to power over 40 percent of the internet.
- Two critical PHP vulnerabilities rated 9.2/10 affect every version since PHP 5
- A patch was expected around 10AM ET Tuesday, but may need manual installation
- Security agencies recommend isolating or taking vulnerable systems offline until patched
Source: theverge.com — Jess Weatherbed, 2026-10-21
Published there as: “A critical PHP vulnerability may take websites down today”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.