Overview
- CERT-EU and the PHP project disclosed two critical vulnerabilities that the project says can let an attacker remotely control a server.
- The PHP project scheduled a security update for 16:00 Dutch time on Wednesday, October 21, 2026, and said it may release fixes sooner if details leak.
- Reports say a brief post with fix details appeared on Hacker News and was removed, increasing pressure to accelerate the public release and warn defenders.
- NotuBiz took raadsinformatiesystemen used by more than a hundred local governments offline as a precaution, with eleven Utrecht municipalities affected and no confirmed breach reported.
- Because an estimated 70% of websites use PHP or derivatives, organisations are advised to prepare to apply patches immediately or to disconnect vulnerable internet-facing PHP services until patched.