I’m subscribed to the Security Now video podcast, and while going over unread email messages, I noticed a Security Alert that Steve Gibson of grc.com considered so urgent that he published this alert in an email message he distributed to his mailing list:
Security Now! FLASH Alert October 21st, 2026
A Very CRITICAL Flaw Revealed in PHP
PHP versions from v5.4 to Current are vulnerable to Remote Code Execution!
A critical vulnerability affecting all PHP versions back to 5.4 allows attackers to execute arbitrary commands on the server without authentication. If you are responsible for any public-facing PHP-based system (Wordpress, forums, etc.) you’ll want to take immediate action.
Reports call this one of the most serious security issues PHP has ever faced. Working exploits are publicly available and attacks are underway. Reuters reports that government websites across Europe and elsewhere have been taken offline to prevent their attack. (See the Reuters Story for more.)
Mitigations can be applied to the PHP.INI configuration file for immediate protection, but the PHP binaries should be updated. Patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
The PHP project’s home page has all the details and mitigations: https://www.php.net/
I’m SURE that next Tuesday’s podcast will have the whole story once this has all unfolded.
I agree that this issue is serious enough that it warrants the broadest possible distribution, so if you’re a member of any other forums, please post this there for me!
We’ve been scrambling since last week at work. We have almost no PHP, but some third party software we use does. There is also a Node.js vulnerability involving a brotli decompression package too.
I’m glad you already knew about this! Since I just found the Alert from GRC today, I wanted to make sure the word has been spread as far and wide as possible! I’ve also posted it on the Garuda Forum too.
I had to fix it on one server last week… Amazed there was only one…
The confusing thing - was the PHP in the default RHEL repo was the exact same version as the one installed : 8.0.30 (with a build date from 2023).
I installed it anyway - reports the exact same version number - but a build date of 20/10/2026.
Note also - some “developers” will package their application with PHP outside of the operating system packaging system… that’s a hideous thing to do - but I’ve seen similar happen before…
Also note : not just Linux / UNIX - I believe Windows systems running PHP are also vulnerable… I don’t have it installed on MacOS or any of my Linux systems…
Here’s what ANNOYS ME about when so called “security experts” flag these things - 99.999 % of the time - systems are >NOT< vulnerable because THEY’RE NOT INTERNET FACING!
I have no idea, because I haven’t dug into this vulnerability beyond relaying GRCs Security Alert so anyone who uses PHP knows to update ASAP., but if a bad actor gains control over a system, thew belongs to them.y can do anything - essentially, your machine now belongs to them … a great reason for regular backups, right?"
But once a vulnerability has been discovered, particularly in something as ubiquitous as PHP, shouldn’t it be widely publicized as possible? And wouldn’t it be true that unless a machine that runs PHP is completely air-gaped, wouldn’t it remain vulnerable?
My association website is on a ovh server and uses wordpress 7.1.3
I checked the security logs and we are on the very latest version plus all my extensions are up to date. Yes its using php for the calendrier system and membership details entry.
But I cannot find a mention of the PHP version, the reports I run just say secure and latest versions.
Do I need to be concerned ?