Checked fact 281926 Oct 2026Safety and security
Stamos said: "They only released a patch for the latest family of PHP and there's a lot of PHP sites on older versions and so upgrading that breaks your site" (03:39). This is his account; the PHP project's own advisory lists fixed releases for four lines, 8.2 to 8.5 (claim 2816).
Toned down to what the source saysThe exact words it rests on
03:39 "They only released a patch for the / latest family of PHP and there's a lot / of PHP sites on older versions and so / upgrading that breaks your site."
What the source said when we opened it, on 26 Oct 2026.
The source
The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos
Checked
Checked by the notis newsroom on , against the source above.
In the story
Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now 26 Oct 2026
Said aloud in a video: the quote, word for word.
Cite this fact
Anyone may quote this address. It does not change; if we correct the story, this page says so.