CISA confirmed active exploitation of two 9.2-severity PHP vulnerabilities allowing unauthenticated remote code execution.

Patches are available across multiple versions.

The vulnerabilities were added to the service's list of known exploitable vulnerabilities. Security researchers confirmed successful attacks on test systems on October 24, 2026.

Which systems are affected?

PHP is used to power about 70% of websites on the internet. According to estimates from analytics firm Censys, more than 32,51 million PHP services were running some of the affected versions.

The issues were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which were released on October 21, 2026.…