Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
wiz.io
· 2026-10-21
The Dutch National Cyber Security Center (NCSC) temporarily took its website NCSC.NL offline as a precaution due to vulnerabilities discovered in PHP. The organization says it is awaiting a security patch from the PHP security team, expected at 16:00 Dutch time, after which it plans to publish an advisory within an hour. The NCSC has also set up a GitHub page with technical details and is compiling an inventory of PHP-related software products affected by the flaws.
ncsc.nl
· 2026-10-21
The PHP Foundation is rolling out patches for two vulnerabilities rated 9.2 out of 10 in severity, following reports of a tool called PHP2Shell that can run malicious code on servers using WordPress, Drupal, MediaWiki and other PHP-based platforms, reportedly affecting every PHP version since 2004. Separately, India-based certificate authority eMudhra disclosed that eight of its intermediate CA certificates—trusted by Mozilla, Microsoft, Apple and Chrome—have weak private keys that could let attackers forge credentials.
engadget.com
· 2026-10-21
GoKawiil