Legal Hackers reported a critical remote execution flaw in PHPMailer, a PHP library used on millions of websites on 26 December 2016. The PHPMailer library is used in WordPress and other popular web applications for sending email and this vulnerability leaves over 9 million websites open to remote code execution.