PHP to issue urgent fix for two CVSS 9.2 flaws amid RCE exploit concerns
_jaydeepkarale · x · 2026-10-21
The PHP security team has announced an emergency release scheduled for October 21, 14:00 UTC, patching two critical vulnerabilities both rated CVSS v4.0 9.2. After details leaked early, watchTowr confirmed both are genuine remote code execution flaws. With PHP powering WordPress, Drupal and most shared hosting, the blast radius is huge — users are urged to inventory their PHP servers and patch immediately. A researcher who saw the POC says it works, though it's not a trivial one-click RCE.
Related event: PHP Core Hit by CVSS 10.0 RCE Flaws, Emergency Patch Set for October 21(11 posts)→
More from Infra
- Uncensored DeepSeek V4.1 Flash GGUFs drop refusal rate from 91.4% to 0% with minimal MMLU loss — kalyan_kpl · 2026-10-21
- First commercial 1024-card Huawei Ascend 950 SuperPoD delivered to StepFun — teortaxesTex · 2026-10-21
- Specter speeds single-GPU MoE inference with quantized multi-step speculative offloading — Wenfeng Wang · 2026-10-21
- SpaceX reportedly targeting 13 GWh of compute by EOY 2027; Grok bots for businesses in weeks — elonmusk · 2026-10-21
- Meta engineer confirms Google TPUs now run AI inference in Meta production — dotey · 2026-10-21
- OmniGraph Open-Sourced: Git-Style Branches and Merges for AI Agent Memory — techNmak · 2026-10-21