CERT-EU 2026-10-20

2026-018: Critical Vulnerabilities in PHP

Machine-generated analysis · WAYSCloud LLM

Two remote-code-execution flaws have been disclosed in PHP, with patches slated for 21 Oct 2026. The advisory urges immediate patching or isolation of internet-facing PHP services.

Context

The advisory concerns the PHP runtime environment. CERT-EU reports that two vulnerabilities could enable remote code execution, though details are not yet public. The PHP foundation plans to release patches on 21 October 2026 at 14:00 UTC.

Operator considerations

Check: Identify all systems running PHP and record their version numbers.
Isolate: Segregate internet-facing PHP applications from public networks until the patch is applied.
Patch: Apply the PHP security release as soon as it becomes available on 21 October 2026.

From Computer Emergency Response Team for the EU institutions ↗

On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks.

At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available.

The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC.

Read the full advisory on CERT-EU →