US government warns critical PHP web flaws are now being exploited in the wild
Exploitation of unauthenticated remote-code-execution flaws in a widely used web language leaves little room for routine patch cycles. Organisations should inventory PHP-based applications, including third-party and legacy systems, and prioritise internet-facing assets now. The fact that exploitation followed within days of patching reinforces the case for faster emergency change processes.
What Happened
The urgent US government warning to patch came less than a week after the makers of PHP released patches for two bugs that let attackers break into a vulnerable system remotely, without passwords. The bugs are rated critical, and researchers said developing a working exploit was initially challenging but not impossible. CISA did not say who was exploiting them in its Monday statement, which followed researcher reports of exploitation.
Why It Matters
Exploitation of unauthenticated remote-code-execution flaws in a widely used web language leaves little room for routine patch cycles. Organisations should inventory PHP-based applications, including third-party and legacy systems, and prioritise internet-facing assets now. The fact that exploitation followed within days of patching reinforces the case for faster emergency change processes.
Sources
- TechCrunch (opens in a new tab): US government says hackers are now exploiting critical PHP web bugs (2026-10-27)
More From This Briefing
- Anthropic files S-1 for proposed IPO, plans Nasdaq listing under ANT
- NVIDIA and Oracle expand Vera Rubin on OCI to multi-gigawatt scale; Vera Rubin NVL72 now available
- OpenAI releases GPT-6.1 Terra at 50% lower API price, aimed at computer-use work
- IIR data show at least $400bn a month in new data centre projects since April 2026
This story is part of the Laurenceo Intelligence briefing for 28 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.