The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. wp.me/pZhYe-5Gb

Critical PHP Security Release

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immedi…

wordpress.org

204

NSA/CSS · Oct 21, 2026 · 1:00 PM UTC

Molly Fisher retweeted

NSA/CSS

@NSAGov19h

We recommend Cisco users disable the Smart Install (SMI) auto-loading feature on all NSS and DIB network devices to mitigate exploitation by remote attackers. Have you taken this action? Read more: media.defense.gov/2019/Jul/1… #CybersecurityAwarenessMonth

The image displays a list titled "SMI Mitigation Actions" with a background of a gear and network motif. The list includes: 1) Disable Smart Install auto-loading feature on all network devices. 2) Review Cisco switch configuration files for deviations from documented pre-existing configurations. 3) Implement deny by default strategy at edge firewall devices and ensure TFTP (UDP port 69) and SMI (TCP port 4786) are denied.

ALT The image displays a list titled "SMI Mitigation Actions" with a background of a gear and network motif. The list includes: 1) Disable Smart Install auto-loading feature on all network devices. 2) Review Cisco switch configuration files for deviations from documented pre-existing configurations. 3) Implement deny by default strategy at edge firewall devices and ensure TFTP (UDP port 69) and SMI (TCP port 4786) are denied.

688

2,669

144,831

Molly Fisher · Oct 21, 2026 · 7:51 PM UTC

😳

A quick explainer for everyone else. >half the internet runs on PHP >a big security bug dropped today >basically hackers can take over websites just by sending one special request (crazy!) >no password needed >patches are out >lots of sites are going down for emergency updates >if you have a website, tell your host to update PHP right now >if you don’t, just enjoy the random maintenance pages for now

250

Molly Fisher · Oct 21, 2026 · 5:41 PM UTC

😐

Molly Fisher · Oct 21, 2026 · 5:37 PM UTC

Molly Fisher

@gridlocking115h

There's evil, and then there is the people who warm up fish in the office microwave.

542

NSA Cyber · Oct 21, 2026 · 1:45 PM UTC

Molly Fisher retweeted

NSA Cyber

@NSACyber19h

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

1,150

9,647

2,505

63,724

10,254,502