Note
The security updates have now been released. For guidance on how to patch the vulnerabilities, please visit: https://www.php.net/archive/2026.php.
Overview
The PHP security team has published an advisory warning administrators to prepare for an emergency batch of security updates at 15:00 BST on Wednesday, October 21st.
PHP is the backbone of many websites and web applications, including e-commerce platforms, content management systems and desktop applications.
There is additional urgency to patch the two critical vulnerabilities each rated 9.2 under the CVSSv4.0 due to information regarding the flaws reportedly being leaked ahead of the scheduled disclosure and patch release.
No technical details about the vulnerabilities, including what version of PHP may be impacted or how they can be exploited by attackers, have been released yet. This is to protect organisations currently using PHP, as an attempt to reduce the exposure. However, full details, affected versions, and the versions which will contain a fix will be published with the release of the security updates.
Impact
Security researchers at watchtower have told BleepingComputer that they believe the two vulnerabilities are Remote Code Execution (RCE) flaws that are presumed to affect PHP versions 5, 6, 7, and 8.
Recommended Actions
Update PHP as soon as the fix is out. Until then use these steps to mitigate the impact of the vulnerabilities on every server that runs PHP.
Locate every PHP host, create an inventory of every PHP install and server, including PHP that is contained within vendor software.
Block any multipart/form-data request bodies, as PHP parses them before the webpage code runs. Reject the requests in your web server, so that PHP never parses them.
If you can afford to take your PHP server offline until the patch has been released and you can update your server, then that would be the best precautionary measure. If you can’t go offline, then make the page or store read-only.
PHP have made it clear that the updates may be released earlier than 15:00 BST, so keep an eye on https://www.php.net/ for information on updates. Ensure that updates are scheduled immediately for the release of the security updates.
Once the update has been released, you will need to fix these vulnerabilities at infrastructure level, by updating the PHP instance on your servers. You cannot fix these issues from within your codebase.
References
PHP Net: PHP News
Bleeping Computer: BleepingComputer Report
Sansec: Sansec PHP2Shell Advice