The PHP project will release security patches for two critical vulnerabilities at 14:00 UTC (23:00 Thai time) today. The flaws have a CVSS v4.0 severity of 9.2, and rumours describe remote code execution affecting PHP 5 through the latest version. Details are not yet public, but PHP reserves the right to release earlier if attacks or leaks appear. If your website, online shop, or booking system runs on PHP (including WordPress or other PHP-based software), check with your web developer or host to confirm the update is installed tonight and take a backup first.