PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
Two critical PHP vulnerabilities, rated CVSS 9.2, enable unauthenticated remote code execution and could allow attackers to steal data, deface sites or take over servers. PHP released fixes for supported versions 8.2–8.5 on October 21, with additional patches for some older versions; operators are urged to update immediately. Early attack activity was reported, and Cloudflare deployed temporary firewall rules. Several European government agencies temporarily took websites offline, while security guidance advised isolating exposed systems that cannot yet be patched. The flaws affect web servers, not users’ personal devices, but compromised sites could be used to present wallet-draining pages. Site owners should confirm their hosting provider has applied the fix; WordPress automatic updates do not patch PHP itself.
