A concise, source-backed briefing on two critical vulnerabilities in the PHP engine. What is affected, what is confirmed, and what defenders should do now.
The vulnerabilities sit in PHP itself, so clean application code does not remove the risk. Web frameworks, content-management systems and embedded products inherit exposure from the runtime.
Remote code execution through out-of-memory corruption as PHP cleans up a crafted request. The flaw crosses the boundary between a failed request and unsafe engine state.
Request-owned global state can survive and poison a later request handled by the same worker process.
PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are in scope. PHP also ships inside appliances, admin interfaces and vendor products where operators cannot update the runtime directly.
Temporary mitigations reduce some exposure, but the security update is the only complete response documented by the PHP project.
Released 21 October 2026 at 14:00 UTC
Find public PHP endpoints, containers, appliances and management interfaces. Record the runtime, SAPI and update owner.
Deploy the fixed PHP release or your distribution/vendor's backported package. PHP 8.1 and older are upstream end-of-life.
Review internet-facing logs and unexpected worker behavior. Track vendor advisories for products that bundle PHP.
Disable session.upload_progress, restart workers and follow PHP's memory_limit, post_max_size and 8.5 backtrace guidance. These are partial mitigations, not fixes.
A compressed chronology based on public advisories and incident research.
The coordinated remediation process begins before public awareness.
watchTowr confirms RCE as vulnerability details become public.
Attempts appear before the coordinated release of fixed PHP builds.
Calif, Wiz, OpenAI and PHP coordinate disclosure. NCSC-NL and CERT-EU publish operational guidance.
Public PoCs require specific conditions and fail on default installations. The patch recommendation does not change.
A source-backed list of sites reported potentially compromised or unavailable during the incident. Do not authenticate, submit information or trust content while an entry is marked AVOID or DOWN.
Editorial policy Every entry requires a public, citable source and timestamps. Entries are moved to CLEARED after verification. The current workbook may contain visibly labelled EXAMPLE.COM rows while verified reports are being collected.
Because information technology is larger than the incident of the day.
A moth found in relay #70 of Harvard's Mark II was taped into the logbook. Grace Hopper helped popularise the story.
symbolics.com became the first registered .com domain on 15 March, years before the public web.
Tim Berners-Lee published the first site at CERN. It described the World Wide Web and how to build a browser.
PHP originally meant “Personal Home Page”. It later became the recursive “PHP: Hypertext Preprocessor”.
Primary operational guidance first, independent analysis second.
itfactly.com is an independent informational publication and is not affiliated with the PHP project or named vendors. Use official vendor advisories for operational decisions. Watchlist entries reflect cited third-party reporting and are labelled accordingly.