PHP Zero‑Day Threatens Millions of Sites

PHP maintainers announced emergency patches for two 9.2‑severity CVEs after purported exploit details and a demo tool (PHP2Shell) appeared. Security firms including Sansec and watchTowr say the flaws affect all supported PHP versions and warn mass attacks will start immediately after disclosure, urging admins to prepare to upgrade. — Shows that widely deployed open‑source runtimes are single points of systemic cyber risk, raising questions about disclosure, national incident response, and requirements for rapid patching in critical infrastructure.