Signals · Cooling · first seen October 29, 2026
FBI and CISA urge immediate PHP updates after AI-assisted reviews turned up two critical flaws
Two flaws in PHP, the language behind WordPress and many other sites, can let an attacker run code on a web server without logging in. PHP shipped fixes on Oct. 21, CISA told organizations to patch at once or take unpatched systems offline, the FBI repeated that on Oct. 23, and CISA listed both as exploited on Oct. 26. The PHP Foundation says outside reviews using AI tools first raised the alarm in August, The Record reported.
Why it matters to a business like yours
If your website, booking form or online store runs on WordPress or other PHP software, the fix sits with whoever hosts or maintains it. Ask them today which PHP version your site runs and whether it has the Oct. 21 fix; CISA says anything on PHP 8.1 or older should stay offline until it is upgraded.
Sources
- Critical Vulnerabilities in PHP Require Immediate Patching (CISA, October 21, 2026)
- Critical Vulnerability Alert: PHP Core (FBI Internet Crime Complaint Center, October 23, 2026)
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 (The Record, October 21, 2026)
History
- October 31, 2026: Cooling