PHP patches two critical remote code execution flaws
What it shows
A sealed junction box with a hinged service door; its green latch stands for the patch that closes both flaws.
Its labels
- New: Patched releases fix both flaws
- Updating is the only complete fix
- mod_php carries the highest risk
The story
PHP patches two critical remote code execution flaws · 23 Oct 2026
An illustration is never a picture of what happened. Drawn on 23 Oct 2026.