Web Security
Ongoing coverage on Web Security.
Latest coverage
Critical PHP Security Flaws Put Millions of Websites at Risk Worldwide
Two critical security vulnerabilities in PHP, a language used by approximately 70% of websites including WordPress, were disclosed on October 21, 2026. These flaws could allow remote access or control of affected servers. The PHP development team has released emergency patches for versions 8.2 through 8.5, urging immediate updates to prevent attacks.
'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes
The PHP security team has announced an upcoming fix for two critical vulnerabilities, rated 9.2/10, with a fix expected at 2 PM UTC. Cybersecurity firms warn that attacks are anticipated to begin within 15 minutes of the release due to leaked information about the flaws. Companies like Cloudflare are already updating firewall rules to mitigate emerging threats.
Google deploys support for Encrypted Client Hello on Android 17
Google has implemented support for Encrypted Client Hello on Android 17, enhancing web security for users. This feature aims to improve privacy and security by encrypting the initial connection handshake.