Two critical decades-old PHP flaws (CVSS 9.2, unauthenticated RCE) found with AI and patched; NSA urges patching or taking sites offline
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…