Critical PHP Flaws Prompt Immediate Update Advice

Adapted by News by Levels October 22, 2026

Server software requires the security patches.

Level 1 Level 2 Level 3

Your learning

Loading your learning…

Technology news editorial illustration for PHP Releases Urgent Fixes for Two Critical Security Flaws

Beginner support · Translation help

Read with help in your language

Choose a language to see each paragraph translated below the English. Tap highlighted words for a quick meaning.

Your language

An that . 8.3.36 and 8.4.27.

their . A an a .

Source: PHP security team, 2026-10-21.

Read · Think · Practise

Try this story

Try 2 questions about this story, then explain one idea in your own words. Check the text whenever you need to.

Print a worksheet · Teacher guide & answers

Read and understand · 1/2Which capability makes the vulnerabilities especially serious? Change only the appearance of a news headline Read only information already made public Run code on a server without signing in

Read the answer and explanation

Run code on a server without signing in. The text describes code execution without authentication, not just a visual error.

Clue: An official PHP advisory identifies two vulnerabilities that can enable unauthenticated remote code execution. Fixed upstream releases include PHP 8.3.36 and 8.4.27.

Read and understand · 2/2What should operators verify rather than relying only on visible site changes? Whether they have rewritten their homepage Whether the hosting provider has installed the PHP fixes Whether they have deleted their browser history

Read the answer and explanation

Whether the hosting provider has installed the PHP fixes. The fault is in PHP. Changing website text or browser history does not patch the runtime.

Clue: Operators using vendor-maintained packages should check their provider's update status. A backported patch may protect an existing version without adopting a newer release number.

Your turn

Why would editing a website’s articles not be enough to fix this issue?

Your answer (not saved or sent)

See one possible answer

The security issue is in PHP on the server. The hosting provider’s installed software needs the relevant fix.

Your answer can be different. Give a reason and use your own words.

0 of 2 questions checked.

Tell us what helped or felt difficult

Which reading level did you try? Was a sentence unclear? Did the questions help you understand the story?

Send feedback by email

Critical PHP Flaws Prompt Immediate Update Advice

Read with help in your language

Try this story

Your turn

Related stories

Britain Expands Planned AI Risk Research

AI Accelerates the Race Between Discovery and Repair

WHO Tracks a Changing Disease Burden

A little English in your inbox.