Kaspersky Warns of Critical PHP Vulnerability

Cybersecurity company Kaspersky is warning organizations about a critical security vulnerability in PHP, a widely used programming language that powers websites, web applications and content management systems such as WordPress. The vulnerability has been assigned a severity rating of 9.2 out of 10 and could allow attackers to execute malicious code on affected servers. Kaspersky urges organizations that rely on PHP to apply the latest applicable security updates promptly to reduce their exposure to potential cyberattacks.

PHP is widely used to operate websites, web applications, content management platforms and backend services. Its extensive deployment means that vulnerabilities affecting the language can create security risks for web servers around the world.

Sergey Lozhkin, Head of the Research Center for APAC and META at Kaspersky’s Global Research and Analysis Team (GReAT), described the vulnerability as a potentially significant cybersecurity incident.

“Given PHP’s role in supporting millions of web servers worldwide, this may prove to be one of the most significant vulnerabilities of 2026,” Lozhkin said.

He noted that the vulnerability’s severity rating of 9.2 highlights the seriousness of the threat. If successfully exploited, it could enable remote code execution (RCE), allowing attackers to run malicious code on affected systems. In some scenarios, attackers could deploy web shells—malicious tools that may provide a means of remotely controlling compromised servers.

Lozhkin warned that vulnerabilities affecting widely deployed technologies can trigger rapidly escalating cybersecurity incidents across the global digital landscape. He stressed that organizations must respond quickly and decisively to reduce the risk.

Kaspersky recommends that organizations whose infrastructure depends on PHP apply the relevant security patches as soon as possible. Prompt remediation is essential to minimizing exposure and protecting critical systems from potential compromise.

The supplied statement does not specify the affected PHP versions, the vulnerability’s Common Vulnerabilities and Exposures (CVE) identifier, or the precise patch details. Organizations should therefore consult official PHP security advisories and verify which updates apply to their deployed versions before taking remediation measures.

//DBTech/RIK/SME/MVNO//