Trusence Every claim has a source
Last updated 26 October 2026 Search Türkçe
Technology

Critical PHP flaws prompt urgent patching across a large share of the web

Many sites were running end-of-life PHP versions, so the one-point-release fix could not be applied quickly everywhere.

26 October 2026 1 min read

Security researchers disclosed critical remote code execution flaws in PHP, the scripting language behind roughly 71% of websites, prompting site operators to patch immediately or take sites offline. The bugs were found by human researchers rather than AI models, though AI tooling was used to exploit them, and the disclosure leaked early through an accidental embargo break. Coverage points to chronic underfunding of the PHP Foundation, which has one full-time staffer and about 14 mostly part-time contractors. A large share of installations were running end-of-life versions, with roughly 73% of servers past EOL and about 7.7% still on PHP 5.x, which made patching far slower than the one-point-release fix would suggest.

Why it matters

The flaws sit in the scripting language behind roughly 71% of websites, so a large number of operators are now under pressure to patch at once or take their sites offline. The gap is wider than the fix itself: a large share of installations were already past end-of-life, and about 7.7% were still on PHP 5.x, which slowed the work considerably. The thin funding behind the PHP Foundation, with one full-time staffer and about 14 mostly part-time contractors, helps explain why so much of the web was running software that no longer receives support.

Series Critical PHP flaws

  1. 26 Oct Critical PHP flaws prompt urgent patching across a large share of the web
  2. 26 Oct Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
  3. 26 Oct Two PHP flaws patched after first confirmed in-the-wild attacks
  4. 25 Oct PHP2Shell flaws used in fast attack on European government, with wider scanning under way
  5. 25 Oct PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack
  6. 25 Oct AI Tools Speed Up Exploits of Long-Known PHP Flaws
The whole series · 16 stories →

Sources · 2

Checked against its sources before publishing · 26 October at 18:12