This Historic Cybersecurity Flaw Put 70 Percent of Websites at Risk. Patch Yours Today If You Haven’t Yet

The critical vulnerability lurks in PHP, a language that underpins sites like Wordpress. The fix is already available.
ZDNet

PHP2Shell: Haven’t patched yet? Take these steps now to mitigate

The PHP Project provides instructions to stop further RCE exploits in limited settings. A flaw in PHP triggered a worldwide scramble to patch vulnerable websites, and now, further instructions have ...
CNBC

AI's 'Black October': Critical PHP flaws set off global security scramble

Cybersecurity teams are racing to patch security flaws in the PHP programming language, which were discovered using advanced AI models. Experts believe the PHP security flaws serve as the latest ...
BleepingComputer

PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. PHP is an open-source web ...
The Hacker News

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects ...
CBC.ca

What is PHP, and how did a flaw in its code lead several websites to go dark this week?

A vulnerability in a critical piece of the internet's infrastructure was exposed this week, sending website operators worldwide scrambling to implement a fix. The problem resided in part of the PHP ...
decrypt

Is the Internet Safe Again After the PHP Nightmare? What You Need to Know

Add Decrypt as your preferred source to see more of our stories on Google. PHP's October 21 releases remain the only fix for PHP2Shell, and they protect a server only once its owner installs them and ...
togetter

もうPHPとか止めて、皆静的HTMLに戻ろう…阿部寛のホームページが正しかったんだ→緊急メンテナンスへ「サーバー側がPHPだから ...

Togetterは、X社が提供するEnterpriseAPIを購入して、ポストを正式に取得・利用しています。Xユーザは、Xの利用規約によりAPI経由でのポストの再利用を許諾しており、その対価を請求してはなら ...
USA Today

Critical security flaw puts most websites at risk as NSA issues warning

Corrections & Clarifications: An update to this story corrects Daniele Molteni's title. A critical security issue in a programming language used in as much as 70% of websites has put much of the ...
notebookcheck

PHP2Shell: Critical PHP flaws hit mod_php servers hardest

Two critical flaws in the PHP interpreter allow code execution without authentication. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that ...

A basic explanation of the 'critical' PHP vulnerability

The cybersecurity issue does not impact everyday consumers' phones or devices but rather the popular websites they may use.
Reuters

Governments, companies take websites offline over PHP flaws

October 22 - Several government, school and hospital websites across Europe and beyond were taken offline on Wednesday as organizations rushed to protect themselves from two critical security flaws in ...