Critical Security Vulnerabilities Discovered in PHP, Prompting Global Warnings and Patching Efforts

Authorities worldwide, including the United States National Security Agency (NSA), have issued warnings regarding two critical security vulnerabilities (CVSS v4.0 score of 9.2) found in the PHP programming language, which powers over 70% of websites. These flaws, reportedly identified with the assistance of artificial intelligence, have led some governments to temporarily take websites offline for protection. Patches are being released, with AWS targeting an upgrade to PHP 8.3.36 for October 22, 2026.