PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit
EthanJPerez · x · 2026-10-21
- Two "critical" vulnerabilities in PHP core itself (CVSS 9.2 out of 10) will get patched builds released late on the 21st JST.
- Because the flaw is in PHP rather than a plugin, plugin vendors can't fix it; it's easy to exploit, automatable, and devastating — anyone running WordPress should plan to patch immediately, as mass attacks will start once the CVE goes public.
- Compromised servers risk being used as attack jumpers, exposing owners to liability. Advice: inventory your WordPress deployments now and rehearse the patch workflow ahead of release.
Related event: PHP Warns of Two Critical CVSS 9.2 Flaws Ahead of Emergency Patch(2 posts)→
More from Infra
- Kernel-by-kernel: why PyTorch beat JAX on the same Noise benchmark recipe — RobertTLange · 2026-10-21
- Jensen Huang: a 1GW AI factory costs ~$50B but yields ~$40B/year — $3.3B lost per month of delay — rohanpaul_ai · 2026-10-21
- Bonsai 2 9B hits 468% speedup on Mac, closing in on 1000 tok/s decode — HankYeomans · 2026-10-21
- Google Cloud to open Vera Rubin-based A5X instances to all customers next month — rohanpaul_ai · 2026-10-21
- Trump: large data centers must generate their own power and pay host communities a dividend — rohanpaul_ai · 2026-10-21
- How PHP-on-WASM sandboxing blocks host escapes: deny-by-default capabilities explained — MickeySteamboat · 2026-10-21