PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offline

Security patches for two critical PHP vulnerabilities were released on October 21, 2026, as government websites in the Netherlands and Finland went offline as a precaution and hackers were reportedly exploiting the flaws. The fixes require action beyond WordPress’s automatic updates, security provider Wordfence warned. Key takeaways PHP developers rated the vulnerabilities 9.2 out of 10. Authorities urged immediate patching or temporary website isolation. Cloudflare’s firewall changes are a stopgap, not a patch replacement. Critical PHP vulnerabilities threaten widely used websites PHP developers disclosed two critical vulnerabilities on October 20, assigning them a severity score of 9.2 out of 10 . Security patches were released on October 21 at 10 a.m. ET.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to The Cryptonomist.