Web

Critical PHP Vulnerabilities Threaten Websites Worldwide

PHP developers have released security patches to address two critical remote code execution vulnerabilities carrying a 9.2 severity rating, as cybersecurity experts warn of immediate exploits.

Radwan AbdulhadiEditor and technology writer

Published: October 22, 2026 · Updated: October 22, 2026 · 3 min read

Critical PHP Vulnerabilities Threaten Websites Worldwide — Image: The Verge

Critical PHP Patches Released

Security patches for the PHP programming language have rolled out with the goal of fixing two critical vulnerabilities that could severely impact the internet if left unchecked. In an advisory published on Tuesday, PHP developers stated that the vulnerabilities carry a severity rating of 9.2 out of a possible 10. Following the release, users are being urged to upgrade as soon as possible.

The security patch was released at 10AM ET. According to cybersecurity firm watchTowr, the flaws are Remote Code Execution exploits that impact every PHP version from PHP 5 onward. These vulnerabilities could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites and steal data.

Discovery and Scale of the Threat

The identification of the critical flaws involved advanced analytical tools, with reports indicating that GPT‑5.6 Sol was used to identify critical PHP flaw aspects during the research process. The broad reach of PHP across web infrastructure means the impact spans a significant portion of the global web.

One security researcher estimated that more than 1.3 million internet-connected hosts are likely affected by the exploit. Additionally, WordPress security plugin provider Wordfence warned that every WordPress site will be vulnerable because they all run on servers utilizing PHP, a platform that powers 40 percent of the internet according to previous statistics.

Wordfence also noted that the fix cannot be installed using automatic updates. Consequently, site owners must determine who is responsible for updating PHP in order to apply the necessary patch manually.

Official Advisories and Mitigation Steps

Due to the severity of the exploits, major international cybersecurity authorities have stepped in. The European Union Computer Emergency Response Team and the UK National Cyber Security Centre both issued advisories encouraging companies that cannot immediately patch their platforms to isolate internet-facing applications from public networks or take them offline entirely.

Organizations are already taking proactive measures. Mobile operating system developer GrapheneOS announced that it temporarily took its user discussion forum offline because proof-of-concept exploits are already being developed and the organization did not want to take the risk.

According to PHP developer Gina Peter Banyard, patching remains the primary mitigation, and turning servers off temporarily might otherwise be the most sensible course of action.

Immediate Attacks and Industry Response

Threat researchers at Sansec expressed expectations of mass attacks occurring shortly after the release of the patch. Attackers are actively moving, with Cloudflare chief technology officer Dane Knecht reporting that early attacks are already emerging against the platform's PHP sites. In response, Cloudflare has temporarily updated its firewall rules to provide a stopgap protection measure until full fixes can be deployed by administrators.