On October 21, the team behind the PHP programming language said it had discovered two vulnerabilities. Both scored 9.2 out of 10 on the CVSS scale, a critical severity rating. The vulnerabilities allow attackers to run code remotely on a server without authentication. This could let them gain unauthorized access to files and databases, insert malicious code or alter a website’s content, redirect traffic to other sites, or use the server for DDoS attacks or spam campaigns.