AI News Feed
Market watch
Dell report finds 64% of IT leaders lack infrastructure fully ready for AIHugging Face Launches SimReady Central Library for Robotics and AI Factory SimulationsMAXHUB launches professional video conferencing terminals for hybrid meetingsTwo severe web security flaws trigger urgent patching warningsHouse committee messages suggest China-based Webull employee had access to U.S. customer dataNVIDIA Adds Nemotron 3.5 Embed, Rerank and Parse to Its Retriever Lineup
Dell report finds 64% of IT leaders lack infrastructure fully ready for AIHugging Face Launches SimReady Central Library for Robotics and AI Factory SimulationsMAXHUB launches professional video conferencing terminals for hybrid meetingsTwo severe web security flaws trigger urgent patching warningsHouse committee messages suggest China-based Webull employee had access to U.S. customer dataNVIDIA Adds Nemotron 3.5 Embed, Rerank and Parse to Its Retriever Lineup
Cybersecurity

PHP patches for critical remote code execution flaws expected today

PHP patches for two critical remote code execution flaws are due today, with unpatched sites urged to isolate or go offline.

AI News Feed · 2026-10-21 20:11

The advisory was published Tuesday by PHP developers, according to The Verge. They said the patch could be released earlier if vulnerability details become public or if there is evidence the exploits are being actively used, and PHP users are being urged to upgrade as soon as the release is available. Cybersecurity firm watchTowr described the vulnerabilities as remote code execution exploits that affect every PHP version from PHP 5 onward. Such flaws could let attackers alter websites, steal data and carry out other malicious activity.

One security researcher estimated that more than 1.3 million internet-connected hosts are likely affected. Wordfence, which provides a WordPress security plugin, warned that every WordPress site will be vulnerable because all of them run on servers that use PHP. WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also warned that the fix cannot be installed through automatic updates, meaning site owners need to determine who is responsible for updating PHP and apply the patch manually.

The European Union Computer Emergency Response Team and the UK National Cyber Security Centre issued advisories encouraging companies that cannot immediately patch their platforms to isolate internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated. GrapheneOS, a mobile operating system developer, said it had temporarily taken its user discussion forum offline because proof-of-concept exploits are already being developed and it did not want to take the risk. PHP developer Gina Peter Banyard said patching is the only mitigation and that otherwise turning servers off might be the most sensible thing to do.

Security organizations have also told PHP administrators to prepare. Threat researchers at Sansec said they expect to see mass attacks within 15 minutes of the release. Cloudflare chief technology officer Dane Knecht said the company was seeing early attacks against PHP sites on its platform and was temporarily updating its firewall rules as a stopgap until the fix is available.

Editor's Summary

PHP is preparing patches for two critical remote code execution vulnerabilities rated 9.2 out of 10, with more than 1.3 million internet-connected hosts potentially affected and every WordPress site exposed because it runs on PHP. Security agencies and researchers are urging immediate manual patching, while GrapheneOS has taken a forum offline and Cloudflare reports early attacks. The patch is expected at 10 a.m. ET, with users urged to upgrade as soon as it is available.