TL;DR: What is the PHP vulnerability, and what should engineering teams do?
The PHP vulnerability announced on 20 October 2026 is a pair of flaws that PHP rates 9.2 out of 10 (CVSS v4.0). The fix came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP confirms remote code execution without a login, so attackers can take over an unpatched server and the CAD files, quotes and customer data on it or behind it. List every PHP system, including vendor portals, back up, patch today, and switch off what you can't patch.
Last updated 4 Nov 2026, 22:30 CET. A successful break-in on an unpatched server is confirmed, and CISA lists both flaws as exploited. Nothing new has come out since 29 October: on 4 November php.net still shows no regular release with the fix for the third issue (CVE-2026-115560), so keep session.upload_progress.enabled=0 until it ships. This was our last scheduled update.
Update 29 Oct, 10:30 CET: The first successful break-in is confirmed, on exactly the setup we flagged for engineering portals. On 26 October BleepingComputer reported that Adel Karimi, detection and response lead at Perplexity, recorded confirmed remote code execution on a honeypot running Apache with mod_php and PHP 8.4.26, an unpatched version. He adds that the test used a deliberately favourable single-worker setup, so it doesn't measure how reliable the exploit is elsewhere. The same day CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, with a 29 October deadline for US federal agencies. Also on 26 October PHP published rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) with Brotli 1.2.1, which fixes CVE-2026-111497, a separate flaw that only reaches Windows builds through cURL when automatic response decompression is switched on. If your quote portal or intranet runs PHP on a Windows server, install those builds. CVE-2026-115560 still has no fix: by 29 October PHP had not shipped its next regular release, so keep session.upload_progress.enabled=0.
Update 25 Oct, 07:16 CET: PHP has flagged a third, narrower issue. In an informational advisory on 23 October at 10:12 UTC, PHP asks everyone to set session.upload_progress.enabled=0 until its next regular bugfix release, to close "an unlikely RCE vector" now tracked as CVE-2026-115560. It only reaches apps that set session.serialize_handler to php_binary or php_serialize in their configuration and then switch it to php with ini_set() before session_start(), and the 21 October releases don't fix it. Custom-built quote and upload portals are where unusual session code tends to hide, so add the setting to every PHP server on your inventory; if you set it as a mitigation on 21 October, keep it. The attacks so far keep failing. Sophos saw attackers try and fail to install a Mirai botnet variant called Potassium, Cloudflare counted millions of attempts by early 22 October, and Censys still counted 34.4 million vulnerable PHP services on 23 October, as The Hacker News reported. The Dutch NCSC wrote at 15:45 on 23 October that it has one report of possible abuse abroad, not confirmed as successful, and that large-scale abuse looks less likely than first thought because exploiting the flaws is complicated. CISA's catalogue of exploited flaws, last updated 23 October, still doesn't list them. One finding matters for engineering firms in particular: SOCRadar found a "one-click" exploit for PHP 8.4.26 on Apache with mod_php on an attacker's server, so an unpatched 8.4 portal on Apache goes to the top of your list. No new PHP release has come out since 21 October.
Update 25 Oct, 07:16 CET: PHP has flagged a third, narrower issue. In an informational advisory on 23 October at 10:12 UTC, PHP asks everyone to set session.upload_progress.enabled=0 until its next regular bugfix release, to close "an unlikely RCE vector" now tracked as CVE-2026-115560. It only reaches apps that set session.serialize_handler to php_binary or php_serialize in their configuration and then switch it to php with ini_set() before session_start(), and the 21 October releases don't fix it. Custom-built quote and upload portals are where unusual session code tends to hide, so add the setting to every PHP server on your inventory; if you set it as a mitigation on 21 October, keep it. The attacks so far keep failing. Sophos saw attackers try and fail to install a Mirai botnet variant called Potassium, Cloudflare counted millions of attempts by early 22 October, and Censys still counted 34.4 million vulnerable PHP services on 23 October, as The Hacker News reported. The Dutch NCSC wrote at 15:45 on 23 October that it has one report of possible abuse abroad, not confirmed as successful, and that large-scale abuse looks less likely than first thought because exploiting the flaws is complicated. CISA's catalogue of exploited flaws, last updated 23 October, still doesn't list them. One finding matters for engineering firms in particular: SOCRadar found a "one-click" exploit for PHP 8.4.26 on Apache with mod_php on an attacker's server, so an unpatched 8.4 portal on Apache goes to the top of your list. No new PHP release has come out since 21 October.
Update 22 Oct, 22:20 CEST: attackers are trying the flaws, and the first signs of success are being investigated. Amazon says its decoy servers caught a first attempt on 17 October, four days before the fix, and that the flaws are "now being broadly exploited in the wild", while it's unclear whether any attempt succeeded. At 16:00 on 22 October the Dutch National Cyber Security Centre (NCSC) said it is investigating first signs of successful abuse; at 13:00 it had still seen none. No break-in has been publicly confirmed so far. In its own tests, CrowdStrike confirmed that a single unauthenticated web request can make Apache with mod_php run an attacker's command, according to SecurityWeek. Vendor appliances matter here: Sophos took its MyUTM portal offline because it ran a vulnerable PHP version. Hosting panels have shipped fixes, with cPanel and Plesk patching PHP 7.4, 8.0 and 8.1 as well, and CloudLinux and DirectAdmin also patched. If a portal or file server stayed unpatched, check its logs, upload folders and admin accounts back to 17 October, as Amazon advises.
Update 21 Oct, 15:50 CEST: PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security advisory confirms that both flaws allow remote code execution without a login: CVE-2026-109618 through out-of-memory handling while PHP parses multipart requests such as file uploads, and CVE-2026-109619 through internal data that outlives its memory. That makes upload and quote portals an obvious target. PHP's verdict: "There are no complete mitigations, updating is the only safe choice."
A PHP vulnerability rated 9.2 out of 10 gets its emergency fix today, and the first job for engineering firms is finding every place PHP runs. Google Trends has "php" trending in the US with 5,000+ searches and a +300% jump, because the news leaked before the patch was ready.
PHP is the programming language behind WordPress and much of the web. At an engineering company it runs the web layer: the WordPress site, the customer and supplier portal, the STEP file download page, the intranet and the parts web shop. Here is what is confirmed, what is only reported, and what to do next.
What did PHP announce, and what is only reported?
On 20 October 2026, PHP posted an advance notice of the security release on php.net. It says the release "addresses two critical vulnerabilities, both rated CVSS v4.0 9.2" and asks every user to "prepare now so they can upgrade as soon as the release is available." The latest releases, 8.5.11, 8.4.26, 8.3.35 and 8.2.34, date from 24 September 2026, and the fixed releases followed on 21 October.
CVSS, the Common Vulnerability Scoring System, rates flaws from 0 to 10. Here is what PHP has now confirmed, and what still comes only from researchers:
PHP's advisory confirms the affected versions: everything before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, on every setup that serves web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed).
Why did the PHP vulnerability leak before the patch?
According to BleepingComputer, a Hacker News post, since deleted, claimed two PHP remote code execution bugs were coming, and the security firm watchTowr confirmed it. watchTowr CEO Benjamin Harris said the bugs were under embargo until Thursday 22 October at 11am ET, and he called them CVSS 10. PHP moved the release up to Wednesday.
An embargo is the quiet period before disclosure. Beazley Security Labs wrote that the leak "broke the embargo that lets hosting providers and Linux distributions ship patched builds alongside the advisory." A screenshot of an exploit tool called PHP2Shell, credited to Calif.IO, leaked too.
Are attackers already exploiting the PHP flaw?
Sources disagree. Sansec reported that Cloudflare saw early attacks against PHP sites at 07:43 UTC on 21 October and pushed firewall rules to all its customers, free plan included. Cloudflare CTO Dane Knecht calls those rules a stopgap. watchTowr's FAQ, updated the same day, says: "As of October 21, 2026, no exploitation in the wild has been reported." Since then, Amazon reported an attempt as early as 17 October, and on 22 October the Dutch NCSC began investigating first signs of successful abuse. On 26 October a successful break-in on an unpatched PHP 8.4.26 honeypot was confirmed, and CISA listed both flaws as exploited (see the update at the top).
Sansec also forecasts mass attacks within 15 minutes of the release. In the Netherlands, several sites went offline as a precaution on 21 October, per Sansec: the tech site Tweakers, the Tweede Kamer (Dutch House of Representatives), the national cyber security centre NCSC and Security.NL. Gina Peter Banyard of the PHP development team told Sansec that patching is the only real fix, and going offline is "the most sensible option" for anyone who can't patch. WordPress and Magento maintenance modes do not help. The list kept growing through 21 October, from Pokémon HOME to Wikimedia's tools and government IT in Germany, France and Belgium; MeanCEO tracks which websites went offline over the PHP issue and how to take a portal offline safely.
Which PHP versions get a fix, and how many sites run old ones?
PHP's supported versions page lists four branches with security support. Here is what each one means for your team today:
W3Techs data from 21 October 2026 shows PHP on 69.3% of websites whose server-side language it can detect. Of those PHP sites, 65.2% run PHP 8, 27.0% PHP 7, 7.7% PHP 5 and 0.1% PHP 4. Inside PHP 8, 15.2% sit on 8.1 and 5.8% on 8.0. By our count, about 48% of PHP websites run a branch without official support. Old portals and vendor appliances live for years, so check your own count.
Why does a PHP flaw put CAD files and design IP at risk?
Remote code execution means an attacker runs their own commands on your server. They read every file the web server can read, plant a hidden back door called a web shell, and use saved passwords to move further. At an engineering firm that reaches:
- drawings and models that customers upload to a quote or review portal;
- STEP, DWG and PDF files on a download page for partners;
- quotes, price lists and margins in a web shop or portal database;
- passwords and access tokens in configuration files that open file shares, email or the ERP system.
We covered where that leads in our guide on ransomware attacks on engineering firms, and in third-party software vulnerabilities in CAD workflows.
What should your engineering team do today?
Work in this order. Steps 1 to 3 come before you patch:
- Inventory every PHP system. Include vendor-supplied portals and appliances that bundle their own copy of PHP, as Beazley advises. Run php -v on each server.
- Ask hosts and vendors for a patch time. Get the date and hour in writing.
- Back up first. Take a full copy of files and database, and keep one copy offline.
- Patch today. Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package, and restart every PHP worker.
- Keep CAD files and design IP off public web servers. A download page links to files; it should not store your master models.
- Restrict portals that the public doesn't need. Put supplier, staff and admin portals behind a VPN or an IP allow-list.
- Isolate what you can't patch. Take it offline or cut it off from the network, then plan the move off PHP 8.1 and older.
- Watch the logs. Look for new admin users, unknown PHP files in upload folders and outgoing connections nobody can explain.
Founders of small engineering startups carry this alone, because there is no security team to call. If you also look after a startup's marketing site, our sister guide covers what tech founders should patch first. For smaller sites, femaleswitch.org has a no-developer plan for small business websites, and femaleswitch.com has a 24-hour plan for freelancers who look after client sites.
How do you protect design IP when the web server is the weak spot?
Patching closes this hole, and the next one will come, so the design files need protection of their own. CADChain's BORIS plugins for SolidWorks, Autodesk Inventor and Blender encrypt and certify CAD files inside the tools your engineers already use, and record each version with proof of who created it and when. For the day-to-day side, see our guide to sharing CAD files with contractors securely.
Protect and prove ownership of your CAD designs. BORIS by CADChain encrypts and certifies design files in SolidWorks, Autodesk Inventor and Blender, and keeps a verifiable record of every version.
👉 Protect your CAD files with CADChain
Conclusion
Two PHP flaws rated 9.2 got their fix on 21 October 2026, the details leaked early, and nearly half of PHP websites run a branch with no official support. For engineering teams, the portals and file shares behind that server hold years of design IP. Find every PHP system today, patch it now, lock down what the public doesn't need, and move your CAD files somewhere a web flaw cannot reach.
- PHP vulnerability: the news and the emergency fix (MeanCEO)
- A no-developer plan for small business websites (Fe/male Switch Foundation)
- A 24-hour plan for freelancers who look after client sites (Fe/male Switch)
- PHP issue: why Pokémon, Wikimedia and government sites went offline, and when to go dark (MeanCEO)
FAQ: the PHP vulnerability for engineering teams
What is the PHP vulnerability of October 2026?
PHP announced two flaws on 20 October 2026, both rated CVSS v4.0 9.2, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are CVE-2026-109618 and CVE-2026-109619, and both allow remote code execution without a login.
Which PHP version fixes the vulnerability?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.
What about PHP 8.1 and older?
PHP 8.1 and older get no official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1 and points users to their Linux distribution or long-term support vendor.
Can a PHP vulnerability expose CAD files?
Yes, if the files sit on the server or the server can reach them. Remote code execution lets an attacker read what the web server reads and use saved passwords to reach file shares.
Are supplier portals and vendor appliances affected?
Any product that runs PHP is in scope, including appliances that bundle their own copy. Beazley advises adding them to your inventory and asking each vendor for a patch date.
Is the PHP flaw being exploited?
Yes. Attempts started on 17 October, when Amazon saw the first one. On 26 October Perplexity's Adel Karimi documented a successful remote code execution on a honeypot running PHP 8.4.26 with Apache mod_php, and CISA added both flaws to its Known Exploited Vulnerabilities catalog. Patch today, and check unpatched systems for signs of a break-in back to 17 October.
What is CVE-2026-115560?
A third PHP issue that PHP flagged on 23 October 2026 in an informational advisory. PHP calls it an unlikely remote code execution vector that only affects apps changing the session serialize handler at runtime. The 21 October releases don't fix it, so set session.upload_progress.enabled=0 on your PHP servers until PHP's next regular bugfix release. By 4 November that release had not shipped.
