PHP compromised, websites must be updated or taken offline warns the NSA

[Legend]

Just finished the hotfix for us 

[Legend]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and…

— ⁵⁄₉ (@fiveoutofnine) October 21, 2026

It's a big deal.