Critical PHP Security Flaws Put Websites at Risk: What Website Owners Need to Know
Two critical security vulnerabilities in PHP, a programming language widely used to power websites, have triggered urgent warnings from cybersecurity
Altro...
Two critical security vulnerabilities in PHP, a programming language widely used to power websites, have triggered urgent warnings from cybersecurity
Altro...Two critical security vulnerabilities in PHP, a programming language widely used to power websites, have triggered urgent warnings from cybersecurity authorities. The flaws could allow attackers to execute malicious code on vulnerable servers without authentication.
The PHP development team released security updates on October 21, 2026, urging users to update immediately.
Why Are the Vulnerabilities Dangerous?PHP runs behind the scenes on many websites, handling tasks such as processing forms, loading content and communicating with databases.
The newly disclosed flaws could allow attackers to run commands on affected servers, potentially exposing sensitive information or compromising websites. Government and cybersecurity agencies have urged organizations to address the vulnerabilities urgently.
Which PHP Versions Are Affected?The PHP team released fixes in these versions:
. PHP 8.5.12
. PHP 8.4.27
. PHP 8.3.36
. PHP 8.2.35
Organizations using older or unsupported versions should consult their hosting provider or software distributor for the appropriate security guidance.
What Should Website Owners Do?Website owners and administrators should identify whether their websites rely on vulnerable PHP installations and apply the relevant security updates as soon as possible.
They should also keep backups, review their hosting provider’s security notices and check that their websites are running supported software.
If an organization cannot apply the fixes immediately, cybersecurity authorities recommend considering temporary isolation of exposed systems until the risk is addressed.
For WordPress.com users: the hosting platform manages the underlying server software, so users generally do not need to update PHP themselves. They should follow official platform security notices and keep their own account and site settings secure.
Can AI Help Find Security Vulnerabilities?The discovery also highlights the growing role of artificial intelligence in cybersecurity. OpenAI reported that AI-assisted research contributed to identifying one of the flaws, while security researchers at Wiz independently discovered and reported both vulnerabilities.
AI can help researchers find weaknesses in widely used software, but the same capabilities may also help attackers develop malicious tools. Timely updates and coordinated security responses remain essential.
The Bottom LineThe PHP vulnerabilities are a reminder that even widely used website technology can contain serious security weaknesses. Applying official security updates promptly is one of the most important steps organizations can take to protect their websites and data.
Sources: PHP official security advisory, NSA, ENISA and Reuters reporting, October 21, 2026.
AI and CybersecurityArtificial intelligence is becoming an important tool in cybersecurity. AI-assisted research can help security experts identify software vulnerabilitiesand improve website protection.
Cookie PolicyTerms of Use. Disclaimer
