NSA Warns of Two Critical PHP Flaws, Advises Taking Unpatchable Websites Offline

The U.S. National Security Agency warned on 21 October 2026 that two critical vulnerabilities, each rated CVSS v4.0 9.2, have been found in PHP. The PHP Foundation issued patches the same day, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NSA advised taking websites that cannot be patched immediately offline until they can be.