🚨 A heads-up for anyone running #WordPress, #Moodle, #Nextcloud or other PHP-based services.
PHP has confirmed two critical vulnerabilities, both rated 9.2/10. Fixes are scheduled for today, 21 October, at 14:00 UTC.
Prepare to patch PHP, not just your applications. CERT-EU advises considering temporary isolation of public-facing services if prompt patching isn't possible.
It sounds pretty bad. Affected versions are not yet confirmed but I've heard 5.4+
https://www.php.net
#PHP #Security #SelfHosting
Doug Belshaw
npub18u…mxzll
2026-10-21 04:55:11 UTC
Author Public Key
npub18uln50vju0xgpzm05l4cymjelnpmx3xxd7k9vcdlmjpzcyvdcveqsmxzllPublished at
2026-10-21 04:55:11 UTCEvent JSON
{
"id": "94987e55fbb227cc65c4bd8498ef73b2c3f9c6a5c4dd151f8abaab768039e9a2",
"pubkey": "3f3f3a3d92e3cc808b6fa7eb826e59fcc3b344c66fac5661bfdc822c118dc332",
"created_at": 1792558511,
"kind": 1,
"tags": [
[
"t",
"wordpress"
],
[
"t",
"moodle"
],
[
"t",
"nextcloud"
],
[
"t",
"php"
],
[
"t",
"security"
],
[
"t",
"selfhosting"
],
[
"proxy",
"https://social.coop/users/dajb/statuses/117477114612452302",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "🚨 A heads-up for anyone running #WordPress, #Moodle, #Nextcloud or other PHP-based services.\n\nPHP has confirmed two critical vulnerabilities, both rated 9.2/10. Fixes are scheduled for today, 21 October, at 14:00 UTC.\n\nPrepare to patch PHP, not just your applications. CERT-EU advises considering temporary isolation of public-facing services if prompt patching isn't possible.\n\nIt sounds pretty bad. Affected versions are not yet confirmed but I've heard 5.4+\n\nhttps://www.php.net\n\n#PHP #Security #SelfHosting",
"sig": "496cef536fa5a4c361c0abb20e1b5104af7c2d80222a8fa536d094f26fdeb84fe1248bc0c7e41639120ddc3439b78b356e95f09b2d5b76e5719f0d23c560ec07"
}