Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Foundation described the delay in fixing it as a structural process failure. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may reverse-engineer the patches to target unpatched systems.
Entenda a falha
A vulnerabilidade
Two critical flaws in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. According to CERT-EU, the attacker needs no account or password and can act over the internet. The impact is data theft, page defacement or full system compromise, and the NSA warned that server files and databases could be exposed. The articles give no CVE IDs, component names or affected version numbers. The PHP Foundation released four updates on 21 October 2026, and defenders should check affected versions against the official advisories.
Como funciona
The articles do not describe the internal mechanism. They say only that a remote, unauthenticated attacker can reach a vulnerable PHP installation over the network and make the server run code or commands. Which input is handled by which PHP component, and the step where it fails, is not stated.
Por que é vulnerável
The articles do not state the technical root cause of either flaw. They say only that the fix came in four updates. For the flaw a researcher first identified in 2024, the PHP Foundation attributed the delay in fixing it to a structural failure in its process. That explains why it stayed unpatched for so long, though not why the code was vulnerable.
Como foi descoberta
Researchers at Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw to PHP's developers on 11 August. Wiz, a security company tied to Alphabet, found the issues independently and reported a second flaw on 24 August, also using AI models. The PHP Foundation acknowledged that one flaw had already been identified by a researcher in 2024. The fixes were published on 21 October. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may study the patches to target unpatched systems.
Explicação gerada por IA a partir da matéria e dos artigos, em 21/10/2026 20:17.
Detalhes técnicos
- CERT-EU confirms the flaws permit remote code execution without authentication or an account.
- Possible impact: data theft, web page defacement, or full system compromise. The NSA warned they could expose server files and databases.
- PHP runs on nearly 70% of sites whose server-side language can be identified, and underpins WordPress (about 40% of websites). Many organizations may not know they are running PHP in third-party products, CMSs or hosting platforms.
- Discovery: Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw on 11 August. Wiz independently found the issues and reported a second flaw on 24 August, also using AI models.
- Don Smith (Sophos CTU) warns that exploitation could be prioritized within hours or days of patch release, including with AI assistance.
Remediação
- Apply the PHP updates immediately; if not possible, isolate or take vulnerable systems offline (NSA, CISA).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services.
- Confirm affected versions against official advisories.
- Monitor PHP and web server processes for unusual activity or unexpected command execution, and check whether compromise occurred before patching.
Linha do tempo
-
Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline
ler a análise desta fonte ocultar
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Foundation described the delay in fixing it as a structural process failure. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may reverse-engineer the patches to target unpatched systems.
Technical Details
- CERT-EU confirms the flaws permit remote code execution without authentication or an account.
- Possible impact: data theft, web page defacement, or full system compromise. The NSA warned they could expose server files and databases.
- PHP runs on nearly 70% of sites whose server-side language can be identified, and underpins WordPress (about 40% of websites). Many organizations may not know they are running PHP in third-party products, CMSs or hosting platforms.
- Discovery: Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw on 11 August. Wiz independently found the issues and reported a second flaw on 24 August, also using AI models.
- Don Smith (Sophos CTU) warns that exploitation could be prioritized within hours or days of patch release, including with AI assistance.
Remediation
- Apply the PHP updates immediately; if not possible, isolate or take vulnerable systems offline (NSA, CISA).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services.
- Confirm affected versions against official advisories.
- Monitor PHP and web server processes for unusual activity or unexpected command execution, and check whether compromise occurred before patching.