On 21 October 2026, PHP published fixes for two critical vulnerabilities that let an attacker run code on a web server without logging in. This is how we dealt with them for the sites we look after.