NSA Warns of Two Critical PHP Vulnerabilities, Advises Taking Unpatchable Sites Offline

The U.S. National Security Agency warned on 21 October 2026 that two critical vulnerabilities in PHP, the language behind many websites, each score 9.2 on the CVSS v4.0 severity scale (0–10). The PHP Foundation released patches the same day in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NSA advised taking unpatchable websites offline until they can be patched.