PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

PHP has issued emergency updates for two critical vulnerabilities that can enable unauthenticated remote code execution across widely deployed web stacks, with active exploitation already being observed. For CIOs and technology leaders, this is a high-severity operational risk that can force emergency outages, accelerate incident response workloads, and expose any internet-facing application running PHP—including platforms like WordPress, Drupal, Joomla, Magento, and shared hosting environments—to compromise if not patched immediately. IT organizations should treat this as a broad asset-discovery and exposure-management event, not just a routine patch cycle, because identifying all embedded PHP instances may be difficult and delayed remediation may require temporary isolation of public-facing services.