Critical unauthenticated PHP flaws (CVSS 9.2) found with AI and patched; NSA urges patching; Brazil, France take sites offline
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…