Update, October 21, 2026, 17:30 UTC: PHP has released the fixes. This article now includes the fixed versions, details of both vulnerabilities, the PHP team’s interim measures, reports of exploitation and the first control panel updates. On October 21, the PHP project released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. The … Continue reading Two Critical PHP Flaws Leaked Ahead of the October 21 Security Release