PHP developers to release patches for two critical flaws; agencies advise isolating systems

PHP's developers said they would release patches on Wednesday, 21 October 2026, for two critical vulnerabilities in the PHP programming language. PHP is widely used to build websites and web applications.

The EU's cybersecurity team, CERT-EU, advised organisations unable to apply the fixes to consider taking affected systems offline or isolating them from public networks. The UK's National Cyber Security Centre (NCSC) issued a similar advisory. The BBC quoted it as saying: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

The flaws have been described as potentially allowing remote code execution on affected servers. According to the BBC, CERT-EU said risk scores "indicate the potential for unauthenticated remote code execution". Cybersecurity firm watchTowr described them as Remote Code Execution vulnerabilities, according to The Verge.

Timing and reported impact

According to the BBC, the PHP Foundation is issuing the updates on Wednesday afternoon. The Verge said the patch was expected at 10:00 ET and could come earlier if details became public or exploitation was detected. According to The Verge, a developer advisory published on Tuesday rated the flaws 9.2 out of 10 for severity.

According to the BBC, the Netherlands' cyber-security agency said it was taking its own website offline, and the Dutch National Institute for Public Health and the Environment has taken down its website. The BBC also said the website of the Tweede Kamer, the lower house of the Dutch parliament, became inaccessible. It did not state the cause. Australian cybersecurity agencies urged users to apply fixes as soon as they are available, the BBC reported.

According to The Verge, GrapheneOS temporarily took its user forum offline, and Cloudflare is updating firewall rules as a stopgap. An unnamed researcher estimated that more than 1.3 million internet-connected hosts are likely affected, The Verge reported.

What remains unclear

Affected versions are not settled. CERT-EU, according to the BBC, and watchTowr, according to The Verge, said versions from PHP 5 onward could be affected. The BBC said this was not yet clear. The reports reviewed by Vocemundi do not include CVE identifiers, though they describe the flaws as remote code execution vulnerabilities. They predate the scheduled release and do not confirm that the patches are out.

What each side says

• Cloudflare CTO Dane Knecht was quoted by the BBC as saying the company is "seeing early attacks emerging and are updating mitigations as new vectors show up". The reports do not include independent confirmation of active exploitation.
• Wordfence said every WordPress site will be vulnerable and the fix cannot be installed through automatic updates, according to The Verge.
• PHP developer Gina Peter Banyard said patching is the only mitigation, and otherwise turning servers off "might be the most sensible thing to do", The Verge reported.
• Sansec researchers expect "mass attacks within 15 minutes of the release", according to The Verge.
• Huntress said PHP underpins WordPress, Drupal, Joomla and Magento sites, among other software, according to the BBC.
• The NCSC advised organisations to keep monitoring third-party vendors for updates, including appliances that may bundle PHP.

Analysis

The coordinated advice from several national agencies suggests officials view the flaws as serious, though the reports reviewed by Vocemundi do not include CVE identifiers or independent confirmation of attacks. The main practical challenge appears to be speed: PHP is often embedded in hosting platforms and third-party products, and Wordfence says the fix cannot be applied automatically. If warnings of rapid exploitation prove accurate, organisations that patch late could face elevated risk. If they do not, temporary website shutdowns may be remembered as precautionary. Clarity on affected versions and on the patch release will likely shape how organisations respond.

Produced by the Vocemundi newsroom with AI assistance.