GoKawiilPHP patches two critical flaws affecting 70% of websites, active exploitation reported
PHP issued an emergency security update fixing two critical vulnerabilities that let attackers run arbitrary code on vulnerable servers, affecting software behind Drupal, Magento, Joomla and WordPress. Researchers at Wiz, who helped discover the bugs along with OpenAI, say every PHP version released in the past decade contains at least one flaw, and Cloudflare and Reuters reported active exploitation and government site outages following disclosure.
GoKawiil's interpretation of the reporting above, not reported fact.
Because PHP underpins a huge share of the web's publishing systems, a flaw of this scope could let attackers compromise large numbers of servers simultaneously, risking data exposure and denial-of-service outages. Wiz and OpenAI characterize this as among the most severe vulnerabilities in PHP's history, suggesting site operators who delay patching face elevated risk until updates are widely applied.
- PHP released an emergency patch for two critical remote-code-execution flaws.
- Wiz says every PHP version from the last decade has at least one of the bugs.
- Cloudflare and Reuters report active exploitation and resulting website outages, including government sites.
Source: krebsonsecurity.com, 2026-10-21
Published there as: “Widespread PHP Flaw May Cause Many Site Outages Today”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.