{"id":696,"date":"2026-10-21T13:01:17","date_gmt":"2026-10-21T13:01:17","guid":{"rendered":"https:\/\/bugleblast.com\/?p=696"},"modified":"2026-10-21T13:01:17","modified_gmt":"2026-10-21T13:01:17","slug":"php-critical-vulnerabilities-patch-or-go-offline-ncsc","status":"publish","type":"post","link":"https:\/\/bugleblast.com\/?p=696","title":{"rendered":"PATCH YOUR WEBSITE OR PULL THE PLUG! | Two 9.2-rated PHP flaws drop today, and cyber chiefs say offline beats unpatched"},"content":{"rendered":"<p>Webmasters, put the coffee down. Organizations that run on the <strong>PHP<\/strong> programming language are being told to install a critical update TODAY or think about taking their websites offline, the <a href=\"https:\/\/www.bbc.co.uk\/news\/articles\/cmly0lg3w5x2o\">BBC<\/a> reported.<\/p>\n<p>The PHP security team gave advance notice on Tuesday of a security release fixing <strong>two critical vulnerabilities<\/strong>, both rated <strong>9.2<\/strong> on the CVSS v4.0 scale, <a href=\"https:\/\/www.php.net\/archive\/2026.php\">per PHP.net<\/a>. The release was scheduled for Wednesday at <strong>14:00 UTC (9am Central)<\/strong>, and the team said it could ship earlier if details went public or attacks showed up in the wild.<\/p>\n<p>The UK\u2019s <strong>National Cyber Security Centre<\/strong> did not mince words: \u201cWhere immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,\u201d it said in an <a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\">alert<\/a>. Its counterparts in the EU and Australia issued similar warnings. CERT-EU said the risk scores \u201cindicate the potential for unauthenticated remote code execution,\u201d meaning attackers could potentially install malware and take sites down.<\/p>\n<p>Some aren\u2019t waiting around. The Netherlands\u2019 cyber-security agency says it is taking its own website offline, and the BBC reports the sites of a Dutch public health agency and the lower house of parliament went dark too. Cloudflare CTO <strong>Dane Knecht<\/strong> said he was \u201cseeing early attacks emerging.\u201d<\/p>\n<p>Why should YOU care? \u201cPHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels,\u201d security firm Huntress said. CERT-EU said the flaws could affect every version back to PHP 5, which launched in 2004. Exact affected and fixed versions are due with the release, so check with your host. Yes, we\u2019re looking at our own server too.<\/p>\n<p><em>Featured image: editorial illustration by Bugle Blast.<\/em><\/p>\n<p><strong>Sources:<\/strong> <a href=\"https:\/\/www.bbc.co.uk\/news\/articles\/cmly0lg3w5x2o\">BBC News<\/a>; <a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\">UK NCSC<\/a>; <a href=\"https:\/\/www.php.net\/archive\/2026.php\">PHP.net<\/a>; also reported by <a href=\"https:\/\/www.theverge.com\/tech\/1015257\/php-vulnerability-patch-website-security-wordpress\">The Verge<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Two 9.2-rated PHP flaws drop today, and cyber chiefs say offline beats unpatched<\/p>\n","protected":false},"author":1,"featured_media":695,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/bugleblast.com\/wp-content\/uploads\/2026\/10\/bb-php-critical-patch-1021.jpg","_links":{"self":[{"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/posts\/696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bugleblast.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=696"}],"version-history":[{"count":0,"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/posts\/696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bugleblast.com\/index.php?rest_route=\/wp\/v2\/media\/695"}],"wp:attachment":[{"href":"https:\/\/bugleblast.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugleblast.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugleblast.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}