IT office of Shir and Khurshid Front
On October 21, 2026, the PHP team announced two critical vulnerabilities that could allow malicious code to run on a server without logging in to a user account.
For political sites, the possible outcome is not just termination or content changes. In case of intrusion, members' names, contact numbers, private messages, documents and donor information may be exposed. Linking people's identity with political activity can provide grounds for threats, pressure on families or targeting them. This is a description of the risk, not a confirmation that a specific site has been compromised.
If you keep sensitive personal information:
1. Immediately get confirmation from the host that the PHP is indeed modified. Revised versions of this alert: 8.2.35, 8.3.36, 8.4.27 and 8.5.12; or an equivalent host-approved security package. A WordPress or security plugin update alone will not fix this flaw.
2. If immediate remediation is not possible, stop public access to the vulnerable service at the web server or network level and suspend receiving sensitive information. Showing the "under repair" page inside WordPress is not enough.
3. Collect only the necessary information. Separate the member identity list from the public site and limit access to essential people. Have separate encryption and management keys for data and backups; Encryption alone does not prevent a master attacker from accessing the application.
4. If you see signs of intrusion, isolate the server and initiate a professional investigation. Keep incident reports and evidence prior to cleanup. Installing a patch alone does not remove the effects of previous intrusions.
5. After containing the intrusion and cleaning the environment, change the passwords and keys at risk from the healthy device and invalidate the active sessions. Enable two-step login for administrators; This action does not replace PHP modification.
6. If there is a credible possibility of information disclosure, notify those at risk quickly, privately, and through a secure route; Do not publish their names or identifying details in public announcements.
Protecting the identity of people should be prioritized over the continuous operation of the site.
