Critical vulnerabilities discovered impacting popular programming language for websites

Oct 21, 2026 - 03:10 PM
classroom with students at terminals

Two critical vulnerabilities have been discovered in Hypertext Preprocessor, or PHP, a widely-used open-source scripted language for web development, its creators announced Oct. 21. The vulnerabilities reportedly impact a majority of the world’s websites. The two issues can allow unauthenticated remote code execution. The notice advises all PHP users to download updates immediately, as all PHP installations serving web requests are at risk. The National Security Agency advised organizations to take their systems offline if an immediate update is not feasible, and that the agency will soon issue specific guidance. An AHA Cybersecurity Advisory released Oct. 21 provides additional details and recommendations.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Headline
AHA podcast discusses implementation of the FBI’s ‘Operation Riptide’ combatting cybercrime
John Riggi, AHA national advisor for cybersecurity and risk, and Brett Leatherman, assistant director of the FBI Cyber Division, break down Operation Riptide,…
Headline
NSA guidance available on simple network management protocol 
The National Security Agency has issued guidance on reducing the risk of simple network management protocol abuse. SNMP consists of a standardized framework…
Headline
Microsoft, Health-ISAC announce disruption to cybercriminal businesses supplying attacks on healthcare, others 
Microsoft and Health-ISAC Oct. 15 announced that they disrupted three cybercriminal businesses that provided services to threat actors to attack more than 75,…
Headline
Webinar to discuss voice threats and ways to improve security
The AHA will host a webinar Oct. 20 at 1 p.m. ET that will explore the evolving voice threat landscape — including voice phishing, or vishing, spoofing and…
Headline
Critical vulnerability discovered in certain Citrix products 
A new critical vulnerability has been discovered in Citrix NetScaler ADC and NetScaler Gateway products, the company announced Oct 8. Citrix said the…
Chairperson's File
Chair File: Strengthening Cybersecurity to Protect Patients and Our Hospitals’ Mission
Public
What does patient safety mean to you? For many, patient safety means what we can see: hand hygiene, infection prevention and control practices, medication…