PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offline

What it is

Two remote code execution vulnerabilities in PHP, rated 9.2 out of 10 by PHP developers. They were disclosed on 20 October 2026, and patches were released on 21 October at 10 a.m. ET. Cybersecurity firm watchTowr described them as flaws that let attackers run their own code on affected servers, potentially altering websites or stealing data. The page gives no CVE identifiers and no fixed version numbers.

Preconditions / Affected

Officials said versions from PHP 5 onward could be affected. Huntress said PHP underlies WordPress, Drupal, Joomla and Magento, as well as shared hosting platforms and control panels. A security researcher estimated that more than 1.3 million internet-connected hosts were likely affected.

Attacks were reported early. Cloudflare chief technology officer Dane Knecht reported early attacks, and Sansec expected "mass attacks within 15 minutes of the release." GrapheneOS closed its user forum temporarily, citing proof-of-concept exploit development.

What to do

• Update PHP on the server itself. Wordfence warned that automatic WordPress updates do not install the PHP fix. Every WordPress site runs on a server with PHP, so owners should find out who manages that server's PHP updates and have the patch applied manually.
• If you cannot patch at once, the EU CERT and the UK NCSC advise isolating internet-facing applications from public networks or taking them offline. Agencies in Europe, Australia, Japan and Britain gave the same advice: update immediately or suspend sites until patched.
• PHP developer Gina Peter Banyard said patching is the only mitigation, and that shutting servers down may be the most sensible alternative.

Caveats

Cloudflare is updating its firewall rules as new exploit vectors appear. Knecht called this "a STOPGAP only" and said to patch as soon as PHP releases the update. The Dutch and Finnish government sites that went offline on 21 October did so as a precaution. The Dutch cybersecurity agency also shut down its own site. The page does not describe the vulnerable code paths or how to detect exploitation.