Search
The PHP security team has issued an urgent alert, announcing that a patch will be released at 22:00 (UTC+8) on October 21, 2026, to address two critical vulnerabilities, each with a CVSS v4.0 score of 9.2. These vulnerabilities may involve remote code execution and can be triggered with default installation configurations, though the specific affected versions and technical details have not yet been disclosed. CERT-EU warns of the potential risk of unauthenticated remote code execution and advises administrators to immediately inventory their PHP applications and update them as soon as the patch is released. Systems that cannot be updated immediately should be isolated from the public network. No exploitation cases have been observed in the wild so far, but historical experience indicates the need for rapid preparation.
-
C114 Communication Network -
Communication Home
