A critical PHP vulnerability may take websites down today

<figure> <img alt="Cybersecurity illustration by Carlo Cadenas." data-caption="This PHP issue sounds like a pretty huge problem. | Illustration by Carlo Cadenas / The Verge" data-portal-copyright="Illustration by Carlo Cadenas / The Verge" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/2025/04/VRG_ILLO_STK001_carlo_cadenas_cybersecurity_virus.jpg?quality=90&#038;strip=all&#038;crop=0,0,100,100" /> <figcaption> This PHP issue sounds like a pretty huge problem. | Illustration by Carlo Cadenas / The Verge </figcaption> </figure> <p class="wp-block-paragraph">Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an <a href="https://www.php.net/archive/2026.php#2026-10-20-1">advisory published on Tuesday</a>, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they're unable to apply the fix immediately.</p> <p class="wp-block-paragraph">The security patch is expected to drop today at 10AM ET - though the developers say they may release it earlier if the vulnerability deta …</p> <p><a href="https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress">Read the full story at The Verge.</a></p>