4 November 2026
PHP vulnerability could let attackers run code on many servers
First reported
Simon Willison and Tom's Hardware ran this on , all on the same day.
- PHP, a programming language that runs a large share of websites, has a flaw that can allow remote code execution with enough attacker knowledge.
- The bug comes from how PHP handles running out of memory: it can leave half-built data behind, which cleanup code then trusts.
- Many servers are exposed because about 73% of PHP installs were running versions no longer receiving security support.
How it was covered
Simon WillisonDaily notes and links
Release of datasette-llm 0.1a10, a bug fix, and the demo site it affected
Reported by Tom's Hardware