Cybersecurity News

Krebs On Security

Widespread PHP Flaw May Cause Many Site Outages Today

October 21, 2026

Matched: OpenAI

A critical pair of PHP vulnerabilities affecting roughly 70% of websites is being actively exploited, with working exploits already circulating. All PHP versions since 5.4 are affected, enabling remote code execution, denial-of-service, and data exposure. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Cloudflare implemented firewall protections early today, while government sites in Europe have already gone offline. Researchers compare the severity to the 2021 Log4Shell flaw.

• php vulnerability
• remote code execution
• zero-day
• web application security
• mass exploitation
• patch management

What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk

August 19, 2026

A website's attack surface includes all exposed components that could be exploited, such as login pages, contact forms, plugins, APIs, and forgotten staging sites or backups. Every added feature introduces new elements requiring management and potential vulnerability. Reducing risk involves identifying and minimizing these exposed components to limit opportunities for attackers to compromise the site.

• attack surface
• website security
• risk management
• vulnerability management
• web application security
• security hardening