The critical vulnerability lurks in PHP, a language that underpins sites like Wordpress. The fix is already available.
Comment