PHP developers are releasing patches today to address two critical vulnerabilities with a severity rating of 9.2 out of 10. These flaws are Remote Code Execution exploits affecting all versions from PHP 5 onwards. Experts estimate that over 1.3 million internet-connected hosts are at risk, including all websites powered by WordPress.
The security update is scheduled for 10 AM ET, though developers may release it sooner if exploit details leak or active attacks are detected. Cybersecurity firms warn that attackers could use these vulnerabilities to run arbitrary code, steal data, or modify websites. Researchers at Sansec anticipate mass exploitation attempts within 15 minutes of the patch release.
Because the fix requires manual installation rather than automatic updates, site owners must coordinate with their server administrators. Organizations like the EU Computer Emergency Response Team and the UK National Cyber Security Centre recommend isolating or taking vulnerable systems offline if immediate patching is not possible. Some entities, such as GrapheneOS, have already taken forums offline as a precaution.
Cloudflare has reported early signs of attacks targeting PHP-based sites and is currently updating firewall rules as a temporary mitigation measure. Developers emphasize that patching is the only permanent solution to secure affected servers against potential compromise.
