Critical PHP Vulnerabilities Threaten Over 1.3 Million Websites, Patch Expected Today
PHP patches due October 21 at 10AM ET target two 9.2/10 Remote Code Execution flaws affecting every version from PHP 5 onward, with an estimated 1.3 million hosts exposed. WordPress sites require manual PHP updates.
Security patches for PHP, the programming language used to build a large share of the world’s websites and web apps, are expected to release on October 21, 2026 at 10AM ET, targeting two critical vulnerabilities that cybersecurity organizations warn could cause widespread damage if left unaddressed.
The vulnerabilities carry a severity rating of 9.2 out of 10. According to cybersecurity firm watchTowr, they are Remote Code Execution exploits affecting every PHP version from PHP 5 onward, potentially allowing attackers to run malicious code on affected servers — enabling them to alter websites, steal data, and more. One security researcher estimates more than 1.3 million internet-connected hosts are likely affected.
PHP developers say the patch may be released earlier than scheduled if vulnerability details become public or if active exploitation is detected. Users are being urged to upgrade as soon as the release is available. Wordfence, a WordPress security plugin provider, warned that every WordPress site is vulnerable because all run on PHP-powered servers. WordPress powers more than 40 percent of the internet, according to the company’s own figures. Wordfence also noted the fix cannot be applied through automatic updates, requiring site owners to manually identify who is responsible for updating PHP and apply the patch themselves.
For those unable to patch immediately, the European Union Computer Emergency Response Team and the UK National Cyber Security Centre have both advised isolating internet-facing applications from public networks or taking them offline entirely. GrapheneOS has already temporarily shut down its user discussion forum, citing proof-of-concept exploits already in development. PHP developer Gina Peter Banyard stated that patching is the only mitigation, and that taking servers offline “might be the most sensible thing to do” otherwise.
Attacks may not wait for the patch to drop. Cloudflare CTO Dane Knecht said the company is “seeing early attacks emerging” against its PHP sites and has temporarily updated firewall rules as a stopgap. Threat researchers at Sansec warned they expect “mass attacks within 15 minutes of the release.”