21/10/2026
If your website runs PHP, patch it today. Not this week. Today.
Two critical flaws in PHP went public yesterday. Both allow remote code ex*****on with no password. Both score 9.2 on CVSS. Government sites in France, the Netherlands, Belgium and Australia were pulled offline as a precaution, and the NSA has told organisations to patch now or take vulnerable systems down.
Our team has been on this since the advisory dropped. We're working through every client site and system we look after, checking PHP versions, applying the patched releases and locking down the ones that can't be upgraded on the spot. If you're a Putti client, you'll hear from us directly.
Why this matters to NZ businesses: PHP sits under WordPress, Laravel, Magento, Drupal and a huge share of custom-built sites and portals. Wiz estimates it runs about 70% of the world's websites. If you don't know what your site runs on, there's a fair chance it's this.
What to do right now:
1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The fix is out.
2. On PHP 8.1 or older? The PHP project isn't shipping a fix. You need a vendor backport or an upgrade, and that's a bigger job.
3. Can't patch today? Set session.upload_progress.enabled=0 and restart every worker. It blocks part of the attack path, not all of it.
If your site is on PHP and you're not sure where you stand, or the person who built it has gone quiet, get in touch today. We'll tell you straight what's exposed and what it takes to fix it.
Sources: php.net security advisory (21 Oct), NZ Herald / AFP (22 Oct).