Critical holes in PHP itself.
Details of two critical flaws in PHP leaked before the fix was ready, and attackers were using them within a day. The flaws let a stranger run their own code on a server running PHP, with no password. The U.S. cyber agency CISA ordered federal agencies to patch.
Every WordPress site runs on PHP. About 1 in 20 still run PHP 7.3 or older, which got no fix at all.
PHP security advisory, October 20. CISA, October 26.


