CISA confirmed active exploitation of two 9.2-severity PHP vulnerabilities allowing unauthenticated remote code execution.
Patches are available across multiple versions.
The vulnerabilities were added to the service's list of known exploitable vulnerabilities. Security researchers confirmed successful attacks on test systems on October 24, 2026.
Which systems are affected?
PHP is used to power about 70% of websites on the internet. According to estimates from analytics firm Censys, more than 32,51 million PHP services were running some of the affected versions.
The issues were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which were released on October 21, 2026. Federal agencies in the US were given until October 29, 2026 to implement the necessary fixes.
READ ALSO
Two serious security vulnerabilities identified in Wasmtime software
Many well-known companies, including ABB, Arista, Broadcom, Citrix, Dell, Cisco, IBM, Microsoft, and Oracle, issued security warnings for their customers.
New update for Windows
On October 26, 2026, the PHP Foundation released new versions exclusively for Windows (8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1). This update fixes a separate security issue related to the Brotli library, affecting versions 1.0.3 through 1.0.9, as well as versions 1.1.0 and 1.2.0.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)