Critical PHP remote code execution flaws threaten every version since PHP 5

A critical flaw in the web's most widely used scripting language

PHP, the programming language behind a large share of the world's websites and web applications, is receiving emergency security patches for two critical vulnerabilities. According to The Verge, an advisory published by the PHP developers on Tuesday assigned the flaws a severity rating of 9.2 out of 10. The fixes were scheduled to arrive at 10AM ET on October 21, though the developers said they could ship earlier if technical details became public or evidence of active exploitation appeared. PHP users are being urged to upgrade as soon as the release is available.

Remote code execution on every version since PHP 5

Cybersecurity firm watchTowr, cited by The Verge, describes both flaws as remote code execution exploits that affect every PHP release from PHP 5 onward. That class of bug allows an attacker to run their own code on an affected server, which could be used to alter websites, steal data or pivot to deeper compromise. One security researcher estimates that more than 1.3 million internet-connected hosts are likely affected.

Agencies recommend going offline if patching is not possible

The European Union Computer Emergency Response Team and the UK's National Cyber Security Centre have both issued advisories on the vulnerabilities. As The Verge reports, they encourage organizations that cannot immediately patch their platforms to isolate internet-facing applications from public networks or take them offline entirely until the flaws are fully mitigated. PHP developer Gina Peter Banyard says patching is the only mitigation available, and that otherwise powering servers down "might be the most sensible thing to do."

WordPress sites will not update automatically

WordPress security firm Wordfence warns that every WordPress site is exposed, because the platform runs on servers that use PHP — and WordPress itself has claimed to power more than 40 percent of the internet. Wordfence also flags a deployment problem: the fix cannot be installed through automatic updates. Site owners need to work out who is responsible for the PHP installation in their hosting stack and have the patch applied manually, which for shared hosting and managed platforms largely means waiting on providers.

Attack activity has already begun

There are signs that attackers are not waiting for the patch to drop. Mobile operating system developer GrapheneOS has temporarily taken its user discussion forum offline, saying proof-of-concept exploits are already being developed and that it does not want to take the risk. Cloudflare chief technology officer Dane Knecht says early attacks are emerging against PHP sites on the company's platform, and Cloudflare is updating its firewall rules as a stopgap until the official fix arrives. Researchers at Sansec expect mass attacks to begin within 15 minutes of the release, underscoring how quickly unpatched servers will be targeted once the patch — and the vulnerability details it contains — become public.

Why it matters

This is a rare case where a single patch touches effectively the entire PHP ecosystem, from small personal blogs to large commercial platforms, because the affected versions span more than a decade of releases. The threat model is also inverted from the usual: the moment the patch is published, exploit development accelerates, so the servers that update slowly become the primary targets. With no automatic update path, the practical defense depends on individual admins and hosting providers acting quickly — and on organizations that cannot patch fast enough following CERT guidance to disconnect affected systems until they can.