Critical vulnerabilities discovered in PHP programming language

On October 21, 2026, developers of the PHP programming language released emergency patches to address two critical vulnerabilities. These flaws, which received a 9.2 severity rating on the CVSS v4.0 scale, posed a high risk of unauthenticated remote code execution. PHP powers approximately 70% of websites worldwide, including platforms like WordPress, Drupal, Joomla, and Magento. The discovery of these bugs prompted widespread concern, as reports surfaced that attackers were already attempting to exploit the vulnerabilities.

In response, many organizations and government agencies in Europe, including those in the Netherlands and Finland, temporarily took their websites offline to perform necessary security updates. In the United Kingdom, nearly three dozen government services were rendered unavailable while security work was conducted. The PHP Foundation, which manages the software, admitted that early indicators of one flaw had been identified by a researcher in 2024 but were overlooked, calling the delay a "structural failure." Cybersecurity agencies, including CERT-EU and the US National Security Agency, have issued urgent advisories for all operators to apply the latest patches immediately to prevent unauthorized intrusions.