importantSYS.SOURCE: The Hacker News• 2026-10-21T14:35:17+05:30

Critical PHP RCE Vulnerabilities (CVSS 9.2) Prompt Emergency Security Release

#vulnerability #security #php #rce

Two critical Remote Code Execution (RCE) vulnerabilities in PHP, rated 9.2 on the CVSS v4.0 scale, have prompted an emergency out-of-cycle security release. The vulnerabilities remain unpatched as of the article's publication, with official confirmation expected after the scheduled October 21 release.

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory.

PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.

Read original article

*** END OF TRANSMISSION ***

> EMUDHRA'S CERTIFICATE AUTHORITY KEYS COMPROMISED DUE TO WEAK CRYPTOGRAPHIC IMPLEMENTATION > UNEP EMISSIONS GAP REPORT 2026: 1.5°C PARIS AGREEMENT TARGET UNACHIEVABLE > CRITICAL PHP RCE VULNERABILITIES (CVSS 9.2) PROMPT EMERGENCY SECURITY RELEASE > UNAUTHORIZED ACCESS TO UPDRAFTCENTRAL KEYS ENABLES BACKDOOR EXPLOITS ON WORDPRESS SITES > U.S. FEDERAL AGENCIES ORDERED TO REMOVE DEEPSEEK PRODUCTS AND HALT NEW ACQUISITIONS > STATE BANK OF INDIA DISCLOSES DATA LEAK INVOLVING 3,897 CUSTOMER RECORDS ON DARK WEB > CISA MANDATES PATCHES FOR EXPLOITED PLEX2SHELL, SIEMENS, AND SITEGUARD VULNERABILITIES > VASILEK BACKDOOR DISCOVERED IN VMWARE TOOLS VIA 2-YEAR RUSSIAN HEALTHCARE BREACH > PILLOWFORT PLATFORM TO CEASE OPERATIONS ON DECEMBER 4, 2026 > BATTLEZONE ONLINE: BROWSER-BASED 3D MULTIPLAYER TANK GAME WITH BZFLAG COMPATIBILITY> EMUDHRA'S CERTIFICATE AUTHORITY KEYS COMPROMISED DUE TO WEAK CRYPTOGRAPHIC IMPLEMENTATION > UNEP EMISSIONS GAP REPORT 2026: 1.5°C PARIS AGREEMENT TARGET UNACHIEVABLE > CRITICAL PHP RCE VULNERABILITIES (CVSS 9.2) PROMPT EMERGENCY SECURITY RELEASE > UNAUTHORIZED ACCESS TO UPDRAFTCENTRAL KEYS ENABLES BACKDOOR EXPLOITS ON WORDPRESS SITES > U.S. FEDERAL AGENCIES ORDERED TO REMOVE DEEPSEEK PRODUCTS AND HALT NEW ACQUISITIONS > STATE BANK OF INDIA DISCLOSES DATA LEAK INVOLVING 3,897 CUSTOMER RECORDS ON DARK WEB > CISA MANDATES PATCHES FOR EXPLOITED PLEX2SHELL, SIEMENS, AND SITEGUARD VULNERABILITIES > VASILEK BACKDOOR DISCOVERED IN VMWARE TOOLS VIA 2-YEAR RUSSIAN HEALTHCARE BREACH > PILLOWFORT PLATFORM TO CEASE OPERATIONS ON DECEMBER 4, 2026 > BATTLEZONE ONLINE: BROWSER-BASED 3D MULTIPLAYER TANK GAME WITH BZFLAG COMPATIBILITY