Breaking: PHP Security Alert!
The PHP Group has published a critical remote code execution vulnerability and all users are advised to update immediately (https://www.php.net/archive/2026.php#2026-10-21-5). CERT-EU has gone as far as advising organizations with public facing PHP services who are currently unable to upgrade to isolate their PHP services from the public internet. (https://cert.europa.eu/publications/security-advisories/2026-018)
What this means for you?
If you have a server running a PHP service, such as one running within a website or application and has not been patched to 8.12, 8.4.27 or 8.2.35, is vulnerable. As this vulnerability can allow unauthenticated remote code to execute on the server, which could allow a malicious third party to hijack a server to serve malicious requests to your users, cause denial of service, or as a launchpad for further unauthorized access leading to theft of data and/or data destruction.
How to remedy?
Webmasters are advised to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the PHP group have published the requsite binary packages on their download page (https://www.php.net/downloads.php?source=Y )
If you are running PHP 8.1 or older, these releases are no longer updated by the PHP Project, and you are strongly advised to migrate to a newer release. However, the PHP Group advise that some distributions and LTS (Long Term Support) vendors may provide backported fixes, and that you should contact your vendor for details.
If you are relying on volunteer maintained repositories such as rpms.remirepo.net, you must switch to distribution packages or build from source code, as the repo above will not be updated today.
However, as an additional remedy the PHP project have provided ‘minimal source-backports’ for PHP 7.4, PHP 8.0 and PHP 8.1 if you do not have access to a LTS vendor due to the seriousness of these vulnerabilities.
PHP has provided some mitigation steps if you cannot patch immediately, however, they only reduce exposure to attack paths and will not necessarily make an installation safe, the best resolution is to ultimately patch your install. Information on mitigation can be found here: https://www.php.net/archive/2026.php#2026-10-21-5
Get Help:
If your business requires assistance with securing PHP please reach out to BayTech as soon as possible so we can reduce your exposure to this vulnerability quickly. Please give us a call on (360) 483-5101 for more information and to book a consultation session.