Security Alert: Important PHP website vulnerability you should know about
On October 21, 2026, the PHP development team disclosed two critical vulnerabilities that let attackers run unauthorized code on affected web servers. Patches are available now. Details: https://www.php.net/index.php#2026-10-21-5
Website owners: patch immediately. Deploy the latest security updates for your PHP version today: 8.2.35/ 8.3.36/ 8.4.27, or 8.5.12 (or newer). For environments running PHP versions earlier than 8.1, apply the official security backports available for PHP 7.4, 8.0, and 8.1. Unpatched systems are at risk of remote compromise, website outages, and unauthorized access to sensitive data.
Users: what you should do. While this vulnerability affects websites, and website owners must act immediately, consumers should also be prepared:
- 1. Change your password if an organization whose website you use tells you it was impacted by this issue.
- 2. Be vigilant against scammers. Cybercriminals may take advantage of this situation. If you receive a text or email claiming a security issue and directing you to a link, don’t click it right away. Go directly to the company’s site or contact the company another way to verify.
- 3. Check your digital health. Make sure your apps and security software are up to date on all devices.
- 4. Use technology to protect yourself. Trend Micro ScamCheck can help you verify suspicious messages. Trend Micro Mobile Security (mobile) or Trend Micro Maximum Security (laptops and desktops) can help keep you safe.