PHP programming language critical security vulnerability October 2026
One page that accretes the verified record as the story develops. Every fact keeps its date and its sources.
Critical security flaws in PHP programming language spark global cyber-security scramble
Cloudflare said it had deployed protections against the PHP2Shell vulnerabilities through its web application firewall.
Cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada and the European Union issued alerts about the vulnerabilities.
Critical PHP security release announced for October 21, 2026
The Laravel team announced both Forge and Cloud will be updated with a fix to a node.js security issue.
The Laravel team is exploring a way to silently patch applications without a redeployment.
Both PHP vulnerabilities are rated 9.2 under CVSS v4.0.
Urgent security fix issued for code used by estimated 70% of websites
The cybersecurity firm watchTowr said Tuesday it believed the vulnerabilities could let attackers run their own code on affected servers.
OpenAI stated they consider the PHP bug to be one of the most impactful vulnerabilities in recent memory.
The PHP Foundation acknowledged that the delay in fixing the vulnerabilities was a structural failure.
“Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.”