Overview
- PHP’s development team published fixes on Wednesday, October 21, 2026, after researchers disclosed two memory-handling flaws that affect server-side PHP builds.
- The flaws can allow remote attackers to execute arbitrary code or seize control of sites and were rated at the highest severity level used for software vulnerabilities.
- The White House coordinated protective steps and the U.S. National Security Agency urged all organizations to apply updates immediately or take vulnerable systems offline if they cannot patch.
- Public bodies and major services across Europe and elsewhere have taken pages or sites offline as a precaution, and Cloudflare and other security firms report seeing attack traffic that targets the bug.
- Because PHP powers a large share of the web and is deployed in many configurations, operators face a wide-ranging, time-consuming task of scanning, patching, testing and restoring services with some citizen-facing interruptions likely to persist.