TechNewsSecurityA critical PHP vulnerability may take websites down todayA patch is about to roll out, but the exploit affects more than 40 percent of the internet.A patch is about to roll out, but the exploit affects more than 40 percent of the internet.by Jess WeatherbedOct 21, 2026, 11:49 AM UTCShareGiftThis PHP issue sounds like a pretty huge problem. Illustration by Carlo Cadenas / The VergeJess Weatherbed is a news writer focused on creative industries, computing, and internet culture. Jess started her career at TechRadar, covering news and hardware reviews.Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.The security patch is expected to drop today at 10AM ET — though the developers say they may release it earlier if the vulnerability details become public or there’s evidence of the exploits actively being used — and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.The impact of these vulnerabilities could be vast, with one security researcher estimating that more than 1.3 million internet-connected hosts are likely affected.
WordPress security plugin provider Wordfence also warned that every WordPress site will be vulnerable because they all run on servers that use PHP, which is no small number given WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also warned that the fix can’t be installed using automatic updates, so site owners need to find out who is responsible for updating PHP to apply the patch manually.The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have both issued advisories that encourage any companies who can’t immediately patch their platforms to instead isolate their internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated. Mobile operating system developer GrapheneOS says they’ve temporarily taken their user discussion forum offline because proof of concept exploits are already being developed and they “don’t want to take the risk.” According to PHP developer Gina Peter Banyard, patching is the only mitigation, and otherwise turning servers off “might be the most sensible thing to do.”Multiple cybersecurity organizations have also prompted PHP admins to prepare, with threat researchers at Sansec saying they expect to see “mass attacks within 15 minutes of the release.” That doesn’t mean attackers are waiting around, however. Cloudflare chief technology officer Dane Knecht says “we are seeing early attacks emerging” against the platform’s PHP sites, and that Cloudflare is temporarily updating its firewall rules as a stopgap until the fix is available.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Jess WeatherbedNewsSecurityTechWebMost PopularThe Gospel according to Peter (Thiel)Can you see everything?Wii Sports is back on the Switch 2, and it rulesSpaceX will try catching Starship and its booster for first time, Musk saysMeta pauses Muse sharing after researchers find AI chats on the webAdvertiser Content FromThis is the title for the native ad
Leave a Reply