PHP zero-days exploits allow unauthenticated remote code execution on nearly every PHP-powered website, including most WordPress sites.
Patches just released for supported versions only. Older installs are left exposed. Mass attacks expected within minutes.
Indian company eMudhra’s private keys were tiny numbers like 4, 56, 66 were cracked under a sec on laptop. Attackers can use this to gain any site.
This lands the same day as critical PHP zero-days enabling access on nearly every PHP site.
Dr.F (Disgruntled Citizen)
npub12k…qp3zn
2026-10-22 00:06:39 UTC
Author Public Key
npub12kvrtgmhzy9gv3g8jsekq5nzlp0p7kg44w8hgk04hvjspwetqd5spqp3znSeen on
wss://relay.mostr.pubPublished at
2026-10-22 00:06:39 UTCEvent JSON
{
"id": "493d66bda1cc912e77735c2bbda89f1aacfcfae47c7f4f993690872f51c01047",
"pubkey": "559835a377110a8645079433605262f85e1f5915ab8f7459f5bb2500bb2b0369",
"created_at": 1792627599,
"kind": 1,
"tags": [
[
"proxy",
"https://freeatlantis.com/users/DrFell/statuses/117481642365461404",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "PHP zero-days exploits allow unauthenticated remote code execution on nearly every PHP-powered website, including most WordPress sites.\n\nPatches just released for supported versions only. Older installs are left exposed. Mass attacks expected within minutes.\n\nIndian company eMudhra’s private keys were tiny numbers like 4, 56, 66 were cracked under a sec on laptop. Attackers can use this to gain any site.\n\nThis lands the same day as critical PHP zero-days enabling access on nearly every PHP site.",
"sig": "56ea706a9fc9656388f2e71e4a0a7c447be9a68acedb125b95f6e13b17e947abd20fa2ea278c1dccc49cadd12249a56fd28fe2d126e9f6e09c8f1d4f51294811"
}