Critical PHP flaws (CVSS 9.2) expose global web servers; Russia's 90% PHP reliance amplifies risk

PHP disclosed two critical remote code execution vulnerabilities on October 21, both rated 9.2 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code on servers. This poses a global threat to websites, with Russia facing particularly high exposure given that PHP powers over 90% of its sites. The vulnerabilities could enable data theft, site defacement, traffic redirection, and use of compromised servers for DDoS or spam, though no active exploitation has been reported yet.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works