PHP developers reported two vulnerabilities that allow remote code execution on servers without requiring authentication.

Vulnerability summary

The flaws permit attackers to run arbitrary code remotely, which can affect many web projects that rely on PHP, including sites powered by WordPress.

Potential impact

A successful exploit can enable data theft, modification of site content, and the deployment of additional malicious tools on compromised servers.

Recommended actions for site owners

Maintainers should apply the released fixes immediately and verify that hosting environments are patched to block unauthenticated remote execution attempts.

• Install official patches provided by the PHP development team without delay.
• Audit server logs and file integrity to detect signs of compromise.
• Limit access to administrative interfaces and review installed extensions for vulnerabilities.

Advice for visitors

If a familiar website requests a wallet seed phrase or asks you to sign transactions without a clear reason, do not provide any credentials or signatures.

Final note

Site operators and users should treat these vulnerabilities as urgent and prioritize updates and verification to reduce the risk of exploitation.