Kaspersky Warns of Critical PHP Vulnerabilities

October 27, 2026 Dhaka, Bangladesh – Kaspersky is highlighting the cybersecurity risks associated with critical vulnerabilities in PHP, a widely used programming language that powers websites, web applications and content management systems such as WordPress. The vulnerabilities have been assigned a severity rating of 9.2 out of 10 and could allow attackers to execute malicious code on affected servers. Kaspersky urges organizations using PHP to apply the latest applicable security updates promptly to reduce their exposure to potential cyberattacks.

Sergey Lozhkin, Head of Research Center for APAC and META at Kaspersky GReAT has commented, “A major cybersecurity incident has emerged: a critical vulnerability has been identified in PHP, a widely used server-side programming language that powers websites, web applications, content management systems such as WordPress, and many backend services across the Internet. Given PHP’s role in supporting millions of web servers worldwide, this may prove to be one of the most significant vulnerabilities of 2026.

The issue has been assigned a severity rating of 9.2, underscoring its critical nature. The potential impact is considerable: If successfully exploited, this vulnerability could enable remote code execution, one of the most serious forms of cyber compromise. In practical terms, attackers could potentially execute malicious code on affected systems, including the deployment of web shells, thereby gaining control over vulnerable servers.

Incidents of this kind can escalate rapidly across the global cyber landscape, particularly when they involve technologies that are so widely deployed. For that reason, the response must be immediate and decisive. If your infrastructure depends on PHP, the patch should be applied as soon as possible, as prompt remediation will be essential to minimizing exposure and protecting critical systems.”