Critical PHP vulnerabilities put breach-notification duties in play
Two critical PHP flaws disclosed on 21 October 2026 affect software behind roughly 70% of the web, turning patch-management failures into questions of notification duty, regulator scrutiny and liability.
A law-firm alert from McDermott Will & Emery, published in November 2026, addresses the legal and regulatory consequences of the two critical PHP vulnerabilities disclosed on 21 October 2026, noting that PHP scripts are used to build roughly 70% of websites on the internet. The analysis is framed around why the disclosure matters to counsel rather than how the flaw works: for a multinational operating consumer-facing services, an unpatched instance could translate into unauthorized access to personal data, converting an engineering ticket into a legal question about notification duties.
Counsel should treat the disclosure as a trigger for a documented, time-stamped patching and exposure assessment covering owned properties, third-party and vendor-hosted applications, and legacy systems outside normal maintenance cycles. Regulators and plaintiffs' counsel increasingly test whether reasonable security steps were taken, so the defensibility of the response record can matter as much as the vulnerability itself. Where affected instances sit in the EU or the UK, the same facts may map onto separate notification regimes and timetables.
The concrete next developments to watch are attribution of actual exploitation incidents, and any regulator inquiries or class-action filings that would convert an operational risk into litigation and notification exposure. Specific affected versions, technical indicators and reporting triggers are not reproduced in the source reviewed here.