Critical PHP RCE flaw under active exploitation after leak; WordPress, Drupal, Magento, Laravel exposed, patch due Oct 21
Patchstack reports a critical remote code execution vulnerability in PHP that is already being actively exploited after details leaked on October 20. Because the flaw sits in the language runtime, any PHP-based application on a vulnerable version is exposed, including WordPress, Drupal, Magento, Joomla and Laravel sites. Patchstack confirmed multiple active exploitation incidents as of 07:34 UTC on October 21. CERT-EU has issued its own warning (advisory 2026-018). The only mitigation is to upgrade PHP, with a fixed release scheduled for October 21 at 14:00 UTC. The article gives no CVE identifier and no affected version range.
Separately, the article notes that an attacker holding valid UpdraftCentral dashboard keys is installing backdoors on connected WordPress sites. It is not stated whether this is linked to the PHP flaw.
Detalhes técnicos
- The vulnerability is an unauthenticated-style RCE in PHP itself, described as allowing anyone to take over affected sites. The article does not describe the root cause or the exact affected versions.
- Exploitation began after partial technical details leaked on October 20.
- The UpdraftCentral activity relies on stolen or valid dashboard keys to push backdoors to connected WordPress sites.
Remediação
- Upgrade PHP to the fixed release as soon as it is published (scheduled for October 21, 14:00 UTC).
- Monitor Patchstack's LinkedIn, Facebook and X accounts for live updates, and read the CERT-EU advisory 2026-018.
- Delete and rotate all UpdraftCentral dashboard keys, and check connected WordPress sites for backdoors.
Linha do tempo
-
Critical PHP RCE flaw under active exploitation after leak; WordPress, Drupal, Magento, Laravel exposed, patch due Oct 21
ler a análise desta fonte ocultar
Patchstack reports a critical remote code execution vulnerability in PHP that is already being actively exploited after details leaked on October 20. Because the flaw sits in the language runtime, any PHP-based application on a vulnerable version is exposed, including WordPress, Drupal, Magento, Joomla and Laravel sites. Patchstack confirmed multiple active exploitation incidents as of 07:34 UTC on October 21. CERT-EU has issued its own warning (advisory 2026-018). The only mitigation is to upgrade PHP, with a fixed release scheduled for October 21 at 14:00 UTC. The article gives no CVE identifier and no affected version range.
Separately, the article notes that an attacker holding valid UpdraftCentral dashboard keys is installing backdoors on connected WordPress sites. It is not stated whether this is linked to the PHP flaw.
Technical Details
- The vulnerability is an unauthenticated-style RCE in PHP itself, described as allowing anyone to take over affected sites. The article does not describe the root cause or the exact affected versions.
- Exploitation began after partial technical details leaked on October 20.
- The UpdraftCentral activity relies on stolen or valid dashboard keys to push backdoors to connected WordPress sites.
Remediation
- Upgrade PHP to the fixed release as soon as it is published (scheduled for October 21, 14:00 UTC).
- Monitor Patchstack's LinkedIn, Facebook and X accounts for live updates, and read the CERT-EU advisory 2026-018.
- Delete and rotate all UpdraftCentral dashboard keys, and check connected WordPress sites for backdoors.