Science & Tech · Cybersecurity · 36 mins ago
Two serious PHP flaws put websites at risk of attack
Two serious flaws have been found in PHP, a programming language used by many websites.
The flaws appear easy to exploit, and hackers have already begun trying to use them.
Notubiz, used for meetings by 100 Dutch municipalities, has been taken offline, as have some ANP systems, both as a precaution.
Cloudflare says its firewall is blocking attempts to exploit the flaws on websites it protects.
If attackers succeed, they could run their own code on a website and potentially steal user data.
A permanent fix is expected at 16:00, after the PHP organization announced a solution the previous day.
PHP announced patches for two critical vulnerabilities rated 9.2 out of 10, warning users to update when fixes are released.
The flaws could let attackers run code on affected servers, putting websites and other PHP-based systems at risk.
Cloudflare said it was seeing early attacks and was updating firewall rules as a temporary measure.
CERT-EU advised organisations to prepare to patch affected systems and consider taking sites offline if they could not update.
Some organisations in the Netherlands, including Notubiz and ANP, took systems offline as a precaution.
- Who
- PHP users and organisations running affected systems are at risk. PHP’s developers announced the planned patches.
- What
- Two critical vulnerabilities could allow attackers to run code on affected servers.
- When
- The vulnerabilities were reported on October 21, 2026. Patches were scheduled for release that day.
- Where
- The flaws affect PHP-based systems worldwide, including websites using WordPress and Drupal.
- Why
- The vulnerabilities may allow unauthorised remote code execution, which could lead to system compromise or data theft.
This story does not have two clearly opposing sides.
CERT-EU issued an advisory urging organisations to prepare to patch affected systems.
PHP announced it would issue patches for two critical vulnerabilities.
Cloudflare said it was seeing early attacks and updating firewall rules as a temporary measure.
The patches were scheduled to be released.
- Severity
- Both vulnerabilities rated 9.2 out of 10
- Affected software
- PHP, including systems using WordPress and Drupal
- Patch time
- Scheduled for 14:00 UTC on October 21, 2026
- Dutch precaution
- Notubiz and ANP took systems offline
- Temporary mitigation
- Cloudflare updated firewall rules while urging users to patch
6 sources
New PHP vulnerability means the Internet will have a very rough couple of days
Two dangerous internet security issues are putting site admins on edge
Patch or go dark: EU cyber officials warn websites over critical PHP flaws
Some websites may go down as huge internet vulnerabilities found, cyber agency warns
Veel websites kwetsbaar voor lekken in populaire programmeertaal
PHP waarschuwt voor twee ernstige bugs die makkelijk uit te buiten lijken
What people are saying
We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update.
upgrade as soon as the release is available
Posts on X
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.