Security flaws in PHP, the server-side scripting language running on an estimated three-quarters of all websites with a known backend. PHP bugs in the runtime itself affect WordPress, Drupal, and virtually every shared-hosting stack simultaneously, making critical RCE and memory-safety flaws in the interpreter among the highest-reach vulnerabilities in the web ecosystem. Combined article + CVE feed for the PHP beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-10-21-php-emergency-patch-critical-rce/https://0daynews.com/articles/2026-10-21-php-emergency-patch-critical-rce/PHP ships out-of-band RCE patches at 14:00 UTC today. Two critical flaws, CVSS 9.2, found by watchTowr. No exploitation confirmed; CVE IDs pending NVD indexing.Wed, 21 Oct 2026 06:00:00 GMTPHParticlehttps://0daynews.com/cve/cve-2012-1823/https://0daynews.com/cve/cve-2012-1823/sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.Wed, 14 Oct 2026 00:00:00 GMTPHPcriticalcvehttps://0daynews.com/cve/cve-2016-10033/https://0daynews.com/cve/cve-2016-10033/PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.Wed, 14 Oct 2026 00:00:00 GMTPHPcriticalcvehttps://0daynews.com/cve/cve-2019-11043/https://0daynews.com/cve/cve-2019-11043/In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.Wed, 14 Oct 2026 00:00:00 GMTPHPhighcve