IT Office of the Lion and Sun Front of Iran
The PHP team announced two critical vulnerabilities on October 21, 2026 that could allow malicious code to be executed on the server without a user account being logged in.
For political sites, the potential consequences are not just content disruption or changes. If compromised, members' names, contact numbers, private messages, documents, and donor information could be exposed. Linking individuals' identities to political activity can be Provide a context for threatening, pressuring, or targeting families. This is a description of the risk, not confirmation that a specific site has been compromised.
If you are holding sensitive personal information:
1. Immediately get confirmation from your host that PHP has indeed been patched. Patched versions of this warning: 8.2.35, 8.3.36, 8.4.27, and 8.5.12; or equivalent security patch approved by the host. Updating WordPress or a security plugin alone will not fix this vulnerability.
2. If immediate remediation is not possible, stop public access to the vulnerable service at the web server or network level and suspend receipt of sensitive information. Displaying a “Repairing” page within WordPress is not enough.
3. Collect only the necessary information. Separate the member identity list from the public site and limit access to essential people. Encrypt and manage keys separately for data and backups; encryption alone will not prevent access by an attacker with control over the application.
4. If you see signs of a breach, isolate the server and initiate a forensic investigation. Preserve incident reports and evidence before cleaning. Installing a patch alone will not remove the effects of a previous breach.
5. After containing the intrusion and cleaning the environment, change the compromised passwords and keys from the healthy machine and invalidate active sessions. Enable two-factor authentication for administrators; this is not a substitute for modifying PHP.
6. If there is a credible possibility of information disclosure, notify those at risk promptly, privately, and through a secure route; do not release their names or identifying details in a public announcement.
Protecting individuals' identities should take priority over the continued operation of the site.
