PHP development team plans to release updates tomorrow to address two vulnerabilities, each rated 9.2; security researchers at watchTowr say they are RCE flaws (Lawrence Abrams/BleepingComputer)

The PHP security team is preparing emergency updates for two critical vulnerabilities that researchers say could enable remote code execution, creating immediate risk for any organization running PHP-based applications or services. For CIOs and IT leaders, this is a high-priority operational issue: teams should assume broad exposure, assess all internet-facing PHP assets and dependent applications, and coordinate rapid remediation to reduce the chance of compromise and service disruption.