PHP Security Team Warns of Two Critical Vulnerabilities, Emergency Patches Expected Imminently

What Happened

The PHP security team has issued an advance warning to administrators that two critical vulnerabilities affecting PHP are set to receive emergency patches imminently. According to reporting from BleepingComputer, details about the flaws reportedly leaked ahead of their originally scheduled disclosure, prompting the accelerated release. At this time, no CVE identifiers, affected PHP versions, or technical root-cause details have been published; the flaws are described only as "critical."

Why It Matters

PHP underpins a large share of the web, from CMS platforms like WordPress and Drupal to countless custom applications and frameworks. A critical vulnerability in PHP itself — rather than in a single application built on it — has a broad blast radius: any organization running affected PHP versions could be exposed, regardless of what software they've layered on top. The fact that details leaked ahead of coordinated disclosure also raises the risk of opportunistic exploitation attempts before patches, or even full advisories, are widely available.

What Defenders Should Do Now

• Inventory all systems running PHP (web servers, application servers, containers, CMS installs) and note current versions, since patch guidance will likely be version-specific once released.
• Watch the official PHP security channels and the referenced BleepingComputer article for the forthcoming advisory and patch details, then prioritize patching based on exposure (internet-facing PHP services first).
• Until specifics are known, review logging and WAF coverage for PHP-fronted applications so you can retroactively hunt for exploitation once indicators or exploit details emerge.
• Avoid acting on unverified technical details that may circulate before the official advisory — wait for the PHP project's confirmed guidance to avoid chasing inaccurate leak information.

Developing Story

This is a developing, net-new item with no CVE or technical details confirmed yet — this post will need to be revisited once PHP's official advisory and patches are published. For the latest, see the original report at BleepingComputer.