Overview
- CERT-EU warned on Wednesday that two newly disclosed PHP vulnerabilities are critical because they can let remote attackers execute code and take control of servers.
- PHP maintainers scheduled a security update for 16:00 CET on Wednesday, 21 October 2026, and said they could release it earlier if exploit details spread.
- Public bodies, hospitals, universities and many municipal sites have been taken offline as a precaution, with platforms such as NotuBiz and parts of the SURF network temporarily disabled.
- Cloudflare reported seeing the first attack attempts targeting the flaws while the Netherlands’ NCSC said it has not detected widespread exploitation but reiterated that any internet-facing PHP instance is likely vulnerable and must be patched immediately.
- Because PHP underpins roughly 70% of websites and often runs on shared hosting or third-party platforms, patching is operationally complex and the ease of automated exploits raises risk of rapid mass compromise and data theft if updates are not applied.