The PHP project released security updates on Oct. 21 for two critical vulnerabilities that could let an unauthenticated attacker run code on an affected server, according to the project's advisory and the U.S. National Security Agency. The NSA says it is prioritizing identification of actors who may exploit the flaws and recommends organizations apply the fixes; the Associated Press reports agencies advised taking vulnerable sites offline if operators could not patch immediately. The advisories establish a serious exposure, not that every PHP site is vulnerable: risk depends on the software version and configuration in use. Sources: PHP security release: php.net source ↗ ; NSA advisory: nsa.gov source ↗ ; Associated Press: apnews.com source ↗