TPO Group urges organizations to inventory and patch PHP sites after critical flaws

Organizations must immediately verify patches for internet-facing applications, according to TPO Group's Tarah Wheeler.

Germany | 22 10 2026, 9:00am ET — TPO Group, the Technology · Policy · Operations cybersecurity consultancy, is advising organizations to inventory every public website running PHP and confirm patches are applied, following the coordinated disclosure of critical remote code execution flaws.

While patches are available, the widespread use of PHP means many organizations remain exposed until they explicitly verify their asset inventory and update their software. PHP runs on roughly 70% of websites with a detectable server-side language, according to W3Techs.

"Memory safety bugs like this one are the asbestos of the internet," said Tarah Wheeler, Chief Security Officer at TPO Group. "We keep stumbling over patches we have to fix and repair. Patches are out, and we haven't seen large-scale exploitation yet, but we won't know the full impact for days. If you run PHP sites, patch them now or ask your provider whether they already have."

On October 21, 2026, researchers disclosed critical remote code execution vulnerabilities affecting multiple versions of PHP, prompting global alerts and emergency patching directives from major infrastructure providers.

AI accelerates exploitation but does not change the fundamental risk

Automated tools are increasingly used to scan for and exploit these unpatched systems. However, this automation is simply faster and more tireless, not particularly smarter. The core issue remains a lack of basic security safeguards on internet-facing assets rather than the emergence of rogue artificial intelligence.

Responsibility rests with technology providers, not end users

Dentists, doctors, and regional utilities cannot reasonably be expected to maintain the same level of cybersecurity vigilance as dedicated practitioners. The burden of security belongs with the large companies that choose to implement customer applications in memory-unsafe languages without transparently communicating the associated risks.

Reflecting on the findings, TPO Group's Chief Security Officer Tarah Wheeler added, "We'll never know that the coast is clear, because this lack of security hygiene means we will always be uncovering patches of it. It's time to update to memory-safe languages on the internet."
— ENDS —

About TPO Group

TPO Group is a mission-critical cybersecurity consulting firm delivering Technology, Policy, and Operations expertise to organizations facing serious cyber threats. Its seasoned practitioners design cloud security for complex infrastructure migrations, build 360-degree security strategy and governance programs, and lead Elite Incident Response against advanced adversaries. TPO Group has offices in Boston, New York, Washington, Seattle, Austin, San Francisco, and London. Learn more at tpo.group.

Media contact

TPO Group Media · info@tpo.group · 855.787.4370