U.S. Agency Warns of Two Severe Security Holes in PHP, Advises Taking Unfixable Websites Offline

The U.S. National Security Agency warned on 21 October 2026 about two severe security holes in PHP, a tool many websites are built with. Each scores 9.2 out of 10 for danger. The PHP Foundation released fixes that day in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NSA advised taking unfixable websites offline until they can be fixed.