Phone Scam and Website Flaws: What Everyday Users Should Do — October 22, 2026

October 22, 2026: this Everyday Security Briefing covers two items. First, the FTC says phone-deactivation threats are a scam; hang up rather than follow the caller’s staged verification.

Second, the PHP project has issued fixes for two critical flaws that could let attackers run code on affected web servers. Operators should update immediately; the advisory does not establish consumer-service or account compromise. If you received the call, act now; otherwise, check a service’s trusted notices for any PHP-related instructions. Other role editions are linked below.

Get this briefing in your inbox → · Or get a notification

Sources checked through Oct 22, 1:13 PM PDT. Published Oct 23, 8:18 AM PDT.

Who this affects People who receive calls impersonating FTC officials and threatening phone-number deactivation; the FTC alert does not establish how many people were contacted. · People using services whose website servers run affected, unpatched PHP installations; the advisory does not identify affected consumer services or accounts.

Phone Scam and Website Flaws: What Everyday Users Should Do — October 22, 2026 — Consumer Security Briefing, 2026-10-22

▶ Watch on YouTube

Watch on YouTube →

Item one: Phone-deactivation calls and the fake verification

Item one. Phone-deactivation calls: the verification is part of the scam. The FTC warned on October 22 about callers impersonating its officials. They claim a phone in your name was used for crimes abroad, threaten to disconnect it, and transfer you to a fake police officer.

The caller may tell you to search for a police number and call it. The FTC says people involved in the scam answer, ask for personal information, and tell callers to keep everything secret. Later, they may claim you are under arrest and demand money. That staged verification is not independent: it keeps you in contact with the scammers and can lead to disclosure of information or payment. The FTC says its employees will not threaten to disconnect your phone, ask for money, or demand secrecy.

If this happens, hang up. Verify any concern through a contact route you already know is genuine, because following the caller's directions keeps you inside the staged check. Report it at ReportFraud.ftc.gov. If you shared information, IdentityTheft.gov offers recovery steps based on what was disclosed. Receiving the call alone does not establish information exposure or financial loss. The alert does not quantify how many people were contacted.

consumer.ftc.gov ↗consumer.ftc.gov ↗

Item two: PHP website-server flaws and what users need to know

Item two. PHP: website operators need an immediate update. PHP runs code behind websites. Its developers announced two critical flaws that can let an attacker send crafted requests and run code on an affected server without signing in. Memory-handling errors create that opening. Successful exploitation could put information or services available to the server at risk.

The warning covers PHP installations serving web requests, with Apache mod_php identified as highest risk. The advisory gives no affected-installation count and identifies no consumer service or account as compromised. A large software population is not the same as a count of stolen accounts.

The PHP project urges immediate updates. If you own a website, ask its host or administrator whether the fix has been applied; replacing the vulnerable code addresses the flaw. Updating your phone cannot fix someone else's server. If you are a visitor, check trusted service notices and follow specific instructions if an incident is reported. This announcement alone does not justify resetting every password.

www.php.net ↗

Useful? Subscribe for your next briefing.