PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offline
Photo: The Cryptonomist
Security patches for two critical PHP vulnerabilities were released on October 21, 2026, as government websites in the Netherlands and Finland went offline as a precaution and hackers were reportedly exploiting the flaws. The fixes require action beyond WordPress’s automatic updates, security provider Wordfence warned. Key takeaways PHP developers rated the vulnerabilities 9.2 out of 10. Authorities urged immediate patching or temporary website isolation. Cloudflare’s firewall changes are a stopgap, not a patch replacement.
Source: The Cryptonomist
