Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Found…