On the 21st of October, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service which handles website traffic. The UK’s National Cyber Security Centre (NCSC) has urged that all PHP fixes are applied immediately, and if this is not feasible ...