CADChain Blog

PHP Vulnerability: What Engineering Teams Must Patch Today to Protect Portals and CAD Files | CADChain | CAD DRM & IP

TL;DR: What is the PHP vulnerability, and what should engineering teams do?

The PHP vulnerability announced on 20 October 2026 is a pair of flaws that PHP rates 9.2 out of 10 (CVSS v4.0). The fix came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP confirms remote code execution without a login, so attackers can take over an unpatched server and the CAD files, quotes and customer data on it or behind it. List every PHP system, including vendor portals, back up, patch today, and switch off what you can't patch.

Developing story. Last updated 21 Oct 2026, 15:50 CEST. PHP has released the fix. We will keep updating this article as reports of attacks come in.

Update 21 Oct, 15:50 CEST: PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security advisory confirms that both flaws allow remote code execution without a login: CVE-2026-109618 through out-of-memory handling while PHP parses multipart requests such as file uploads, and CVE-2026-109619 through internal data that outlives its memory. That makes upload and quote portals an obvious target. PHP's verdict: "There are no complete mitigations, updating is the only safe choice."

A PHP vulnerability rated 9.2 out of 10 gets its emergency fix today, and the first job for engineering firms is finding every place PHP runs. Google Trends has "php" trending in the US with 5,000+ searches and a +300% jump, because the news leaked before the patch was ready.

PHP is the programming language behind WordPress and much of the web. At an engineering company it runs the web layer: the WordPress site, the customer and supplier portal, the STEP file download page, the intranet and the parts web shop. Here is what is confirmed, what is only reported, and what to do next.

What did PHP announce, and what is only reported?

On 20 October 2026, PHP posted an advance notice of the security release on php.net. It says the release "addresses two critical vulnerabilities, both rated CVSS v4.0 9.2" and asks every user to "prepare now so they can upgrade as soon as the release is available." The latest releases, 8.5.11, 8.4.26, 8.3.35 and 8.2.34, date from 24 September 2026, and the fixed releases followed on 21 October.

CVSS, the Common Vulnerability Scoring System, rates flaws from 0 to 10. Here is what PHP has now confirmed, and what still comes only from researchers:

Claim	Source	Status
Two flaws, each rated CVSS v4.0 9.2	PHP (php.net)	Confirmed
Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35	PHP (php.net)	Confirmed
Remote code execution without a login	PHP security advisory	Confirmed
IDs CVE-2026-109618 and CVE-2026-109619	PHP security advisory	Confirmed
All servers on PHP 5.4 or later are affected	Sansec	Reported
No official release for PHP 8.1 and older	PHP security advisory	Confirmed (source backports only)
Attacks already seen	Cloudflare via Sansec, watchTowr	Sources disagree

PHP's advisory confirms the affected versions: everything before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, on every setup that serves web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed).

Why did the PHP vulnerability leak before the patch?

According to BleepingComputer, a Hacker News post, since deleted, claimed two PHP remote code execution bugs were coming, and the security firm watchTowr confirmed it. watchTowr CEO Benjamin Harris said the bugs were under embargo until Thursday 22 October at 11am ET, and he called them CVSS 10. PHP moved the release up to Wednesday.

An embargo is the quiet period before disclosure. Beazley Security Labs wrote that the leak "broke the embargo that lets hosting providers and Linux distributions ship patched builds alongside the advisory." A screenshot of an exploit tool called PHP2Shell, credited to Calif.IO, leaked too.

Are attackers already exploiting the PHP flaw?

Sources disagree. Sansec reported that Cloudflare saw early attacks against PHP sites at 07:43 UTC on 21 October and pushed firewall rules to all its customers, free plan included. Cloudflare CTO Dane Knecht calls those rules a stopgap. watchTowr's FAQ, updated the same day, says: "As of October 21, 2026, no exploitation in the wild has been reported."

Sansec also forecasts mass attacks within 15 minutes of the release. In the Netherlands, several sites went offline as a precaution on 21 October, per Sansec: the tech site Tweakers, the Tweede Kamer (Dutch House of Representatives), the national cyber security centre NCSC and Security.NL. Gina Peter Banyard of the PHP development team told Sansec that patching is the only real fix, and going offline is "the most sensible option" for anyone who can't patch. WordPress and Magento maintenance modes do not help. The list kept growing through 21 October, from Pokémon HOME to Wikimedia's tools and government IT in Germany, France and Belgium; MeanCEO tracks which websites went offline over the PHP issue and how to take a portal offline safely.

Which PHP versions get a fix, and how many sites run old ones?

PHP's supported versions page lists four branches with security support. Here is what each one means for your team today:

PHP branch	Security support until	What to do
8.5	31 Dec 2029 (active support)	Install 8.5.12 today
8.4	31 Dec 2028 (active support)	Install 8.4.27 today
8.3	31 Dec 2027 (security fixes only)	Install 8.3.36 now, plan the next upgrade
8.2	31 Dec 2026 (security fixes only)	Install 8.2.35 now, upgrade before the year ends
8.1 and older	Ended	No official release. Get a backported package from your vendor or distribution, isolate, then migrate

W3Techs data from 21 October 2026 shows PHP on 69.3% of websites whose server-side language it can detect. Of those PHP sites, 65.2% run PHP 8, 27.0% PHP 7, 7.7% PHP 5 and 0.1% PHP 4. Inside PHP 8, 15.2% sit on 8.1 and 5.8% on 8.0. By our count, about 48% of PHP websites run a branch without official support. Old portals and vendor appliances live for years, so check your own count.

Why does a PHP flaw put CAD files and design IP at risk?

Remote code execution means an attacker runs their own commands on your server. They read every file the web server can read, plant a hidden back door called a web shell, and use saved passwords to move further. At an engineering firm that reaches:

drawings and models that customers upload to a quote or review portal;
STEP, DWG and PDF files on a download page for partners;
quotes, price lists and margins in a web shop or portal database;
passwords and access tokens in configuration files that open file shares, email or the ERP system.

We covered where that leads in our guide on ransomware attacks on engineering firms, and in third-party software vulnerabilities in CAD workflows.

What should your engineering team do today?

Work in this order. Steps 1 to 3 come before you patch:

Inventory every PHP system. Include vendor-supplied portals and appliances that bundle their own copy of PHP, as Beazley advises. Run php -v on each server.
Ask hosts and vendors for a patch time. Get the date and hour in writing.
Back up first. Take a full copy of files and database, and keep one copy offline.
Patch today. Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package, and restart every PHP worker.
Keep CAD files and design IP off public web servers. A download page links to files; it should not store your master models.
Restrict portals that the public doesn't need. Put supplier, staff and admin portals behind a VPN or an IP allow-list.
Isolate what you can't patch. Take it offline or cut it off from the network, then plan the move off PHP 8.1 and older.
Watch the logs. Look for new admin users, unknown PHP files in upload folders and outgoing connections nobody can explain.

Founders of small engineering startups carry this alone, because there is no security team to call. If you also look after a startup's marketing site, our sister guide covers what tech founders should patch first. For smaller sites, femaleswitch.org has a no-developer plan for small business websites, and femaleswitch.com has a 24-hour plan for freelancers who look after client sites.

How do you protect design IP when the web server is the weak spot?

Patching closes this hole, and the next one will come, so the design files need protection of their own. CADChain's BORIS plugins for SolidWorks, Autodesk Inventor and Blender encrypt and certify CAD files inside the tools your engineers already use, and record each version with proof of who created it and when. For the day-to-day side, see our guide to sharing CAD files with contractors securely.

Protect and prove ownership of your CAD designs. BORIS by CADChain encrypts and certifies design files in SolidWorks, Autodesk Inventor and Blender, and keeps a verifiable record of every version.

👉 Protect your CAD files with CADChain

Conclusion

Two PHP flaws rated 9.2 got their fix on 21 October 2026, the details leaked early, and nearly half of PHP websites run a branch with no official support. For engineering teams, the portals and file shares behind that server hold years of design IP. Find every PHP system today, patch it now, lock down what the public doesn't need, and move your CAD files somewhere a web flaw cannot reach.

FAQ: the PHP vulnerability for engineering teams

What is the PHP vulnerability of October 2026?

PHP announced two flaws on 20 October 2026, both rated CVSS v4.0 9.2, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are CVE-2026-109618 and CVE-2026-109619, and both allow remote code execution without a login.

Which PHP version fixes the vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.

What about PHP 8.1 and older?

PHP 8.1 and older get no official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1 and points users to their Linux distribution or long-term support vendor.

Can a PHP vulnerability expose CAD files?

Yes, if the files sit on the server or the server can reach them. Remote code execution lets an attacker read what the web server reads and use saved passwords to reach file shares.

Are supplier portals and vendor appliances affected?

Any product that runs PHP is in scope, including appliances that bundle their own copy. Beazley advises adding them to your inventory and asking each vendor for a patch date.

Is the PHP flaw being exploited?

PHP's advisory describes a demonstrated exploit but doesn't report attacks in the wild. Sansec reported early attacks seen by Cloudflare on 21 October, while watchTowr said none had been reported. Patch today either way.

Violetta Bonenkamp, CADChain co-founder

2026-10-21 13:52 Guides