News by Levels · Level 3 · Student worksheet

Critical PHP Flaws Prompt Immediate Update Advice

Name: __________________________ Date: __________________

Read the story

An official PHP advisory identifies two vulnerabilities that can enable unauthenticated remote code execution. Fixed upstream releases include PHP 8.3.36 and 8.4.27.

Operators using vendor-maintained packages should check their provider's update status. A backported patch may protect an existing version without adopting a newer release number.

Source: PHP security team, 2026-10-21. https://www.php.net/archive/2026.php

Read and practise

1. Which capability makes the vulnerabilities especially serious?

   1. Change only the appearance of a news headline
   2. Read only information already made public
   3. Run code on a server without signing in

2. What should operators verify rather than relying only on visible site changes?

   1. Whether they have rewritten their homepage
   2. Whether the hosting provider has installed the PHP fixes
   3. Whether they have deleted their browser history

Your turn

Why would editing a website’s articles not be enough to fix this issue?

________________________________________________________________
________________________________________________________________
________________________________________________________________

Read online: https://newsbylevels.com/news/php-critical-security-fixes-october-2026/level-3/