“ Weather safety information will be broadcast on our social networks while we work to restore our services. ”
On Wednesday, October 21, Météo France made this announcement. It had just taken offline its forecast site and its Vigilance site. The reason: the presence of two “critical” vulnerabilities affecting PHP.
The prefecture sites were treated the same way. The City of Paris, among others, also had to temporarily disconnect. As did the CNIL.
The incident obviously did not stay limited to public sector bodies. Orange, for example, disconnected “a number of websites, services and applications within several subsidiaries and entities.”
PHP signals a third vulnerability
In the Netherlands, the Tweede Kamer, the lower house of Parliament, also had to temporarily shut down its website. The national CERT did the same. It now says it is investigating “early signs of successful exploitation” of the two vulnerabilities. The situation could, it notes, deteriorate quickly, as PoCs are public.
Eye Security acknowledges this, but does not believe a generic exploit is possible. That does not rule out targeted attacks, it clarifies. But, according to them, there is no apocalypse to expect.
The German ANSSI (BSI) is less declarative. However, it asserts not to be aware of any exploitation that is “widespread and successful.” Despite rumors, it adds, the fixes are effective.
The PHP project has just tempered expectations: even with patched versions, a case of RCE may still occur. A specific identifier has been assigned to it (CVE-2026-115560). It requires, however, an unusual combination of configuration and application code that creates a mismatch in the session manager. In this context, there is no plan for a patch outside the regular release cycle.
The PHP fixes have rippled into Linux distributions
The current fixes include patched versions of PHP 8.2, 8.3, 8.4 and 8.5, as well as a minimal backport to three older versions (7.4, 8.0 and 8.1).
Canonical has patched the current Ubuntu release (26.10), which uses PHP 8.5. It has done the same for the three latest LTS releases (26.04, 24.04 and 22.04, which use respectively PHP 8.5, 8.3 and 8.1). For Ubuntu Pro subscribers, it has backported four more versions: 20.04 (PHP 7.4), 18.04 (7.2), 16.04 (7.0) and 14.04 (PHP 5).
The Debian project has integrated fixes for PHP 8.2 and 8.4, respectively in the Bookworm and Trixie repositories. Freexian has backported to Sketch (PHP 7.0), Buster (7.3) and Bullseye (7.4).
Red Hat, outside extended support, has patched RHEL 8 (PHP 8.2 & 7.4), RHEL 9 (8.3 & 8.2) and RHEL 10 (8.4).
SUSE has backported up to PHP 7.4 for openSUSE 15.6/15.7 and SLES 12/15.
70 % of the web under threat? The attack surface in numbers
The two flaws lie in the core of PHP: the Zend engine, which compiles source code to bytecode, executes it and manages everything the language needs. Their placement in the execution stack amplifies their severity. Indeed, they can be triggered before any extensions initialize and before the application code is compiled.
As a result, a widely cited statistic circulates: 70% of the web would be affected. When a source is given, it often points to W3Techs, a platform that analyzes market shares of web technologies. Among sites for which server-side programming language is known, nearly 70% indeed use PHP.
| Branch | Version | Share | Distribution |
|---|---|---|---|
| PHP 8 Total: 45.3 % |
PHP 8.6 | < 0,1 % | |
| PHP 8.5 | 2,0 % | ||
| PHP 8.4 | 5,5 % | ||
| PHP 8.3 | 15,8 % | ||
| PHP 8.2 | 12,5 % | ||
| PHP 8.1 | 6,8 % | ||
| PHP 8.0 | 2,6 % | ||
| PHP 7 Total: 18,6 % |
PHP 7.9 | < 0,1 % | |
| PHP 7.5 | < 0,1 % | ||
| PHP 7.4 | 13,7 % | ||
| PHP 7.3 | 2,0 % | ||
| PHP 7.2 | 1,6 % | ||
| PHP 7.1 | 0,7 % | ||
| PHP 7.0 | 0,7 % | ||
| PHP 5 Total: 5,3 % |
PHP 5.6 | 2,9 % | |
| PHP 5.5 | 0,4 % | ||
| PHP 5.4 | 0,8 % | ||
| PHP 5.3 | 0,8 % | ||
| PHP 5.2 | 0,4 % | ||
| PHP 5.1 | < 0,1 % | ||
| PHP 5.0 | < 0,1 % | ||
| PHP 4 Total: < 0,1 % |
All versions combined | < 0,1 % | |
| Total servers running PHP | ≈ 69,2 % | PHP 8, 7, 5 and 4 | |
| Servers not using PHP | ≈ 30,8 % | Other technologies / languages | |
Where the Mirai botnet is back in the conversation
On October 20, the day before the fixes were published, a PoC leaked. Consequently, the PHP project issued an early warning.
AWS identified attack attempts following the leak. It says it observed one as early as October 17. It originated from an IP address associated with a “commercial anonymization network.”
Ellio also observed attacks before the patch release. The first clearly leaned on the leaked PoC. Its User-Agent included the string “php2shell” and the identifier of the first CVE (109618). It also carried the session-tracking payload field specific to the other vulnerability (109619).
Soon after the patches were released, attack attempts reused the security bulletin’s information. They thus concentrated on a vector other than the upload sessions. Specifically, the one exploiting memory exhaustion. Ellio thus found requests with dozens of nesting levels and relatively large bodies (hundreds of kilobytes). He witnessed payloads ranging from a Go-written RAT to an IIS webshell, including… a 64-bit Mirai IoT botnet version compiled for servers; among other capabilities, it could, among others, open an interactive shell on a pseudo-terminal.
Two vulnerabilities, many attack paths
For memory, the first flaw, introduced with PHP 7.3 (December 2018), targets the hash table implementation. The idea is to forward a POST request that is large enough to exceed memory—yet remains within PHP’s apparent limits—to trigger an out-of-memory (OOM) condition. When this happens, Zend raises a fatal error. Execution halts… and leaves residual bytes. Partially initialized data that the cleanup step can then treat as valid, opening a path to arbitrary code execution.
The second flaw uses the same mechanism of reusing corrupted data, but it is less autonomous. It requires a poisoning step, followed by a targeted trigger on the same worker. In exchange, it reaches a larger set of internal states. The two recognized attack paths are found in code lines introduced with PHP 7.1 and 5.4. Malicious data are deserialized before any application code runs. No application logic can oppose this, and every PHP endpoint (static forms, authentication routes, availability probes, etc.) becomes an attack surface.
In case patches cannot be deployed, the primary mitigation for the first vulnerability is to set memory_limit = -1. At the edge or in the WAF, one can block requests that exceed a certain size. This is not possible for the second vulnerability, where requests typically weigh a few hundred bytes. Here, the best mitigation, in the absence of a patch, is to disable the upload session tracking. Numerous CERTs across Europe — including in Estonia — confirm this approach.
The mitigating measures for the second vulnerability are also applicable to CVE-2026-115560.
From the Codex skill to Zeek rules, defense is taking shape
Having detected attacks on its customers, Cloudflare did not wait for patched versions to launch rules on its WAF.
OpenAI published a PHP version checker as a Codex skill. Meanwhile, Corelight released detection packs for Zeek and Suricata.
The Suricata pack contains three rules. One targets a unique marker in the bodies of HTTP POST requests. The others detect PHP versions by inspecting the banners in response headers as well as in the standard HTML produced by phpinfo().
The Zeek pack gathers 9 alert types among which:
- Abnormally long field name
- Excessive repetition of an MIME header pattern in a multipart request
- Abnormally large representation of a serialized integer token
- Suspect HTTP transactions correlated and associated with the same session within a defined time window
Who gets the “killer PoC”?
The CERT of Luxembourg recommends paying particular attention to:
- Sites, APIs and applications exposed to the Internet
- Shared and multi-tenant hosting environments relying on persistent workers
- CMS, e-commerce platforms and administration interfaces
- Containers, VM images, appliances and web hosting control panels that bundle their own PHP runtime
Its Czech counterpart lists a few signals to monitor on affected servers. Among them:
- Unusual multipart requests followed by memory limit errors or repetitive HTTP 500 responses
- Abnormally large PHPSESSID cookies in responses
- unexplained restarts of PHP processes
In parallel, AWS suggests blocking multipart requests at the frontend for applications that do not require file uploads.
Abstract provides the same advice. It also shares indicators to watch for, including fatal errors containing the phrase Unknown on line 0 — this indicates memory exhaustion occurring before execution. It also notes reproducing an RCE in two requests from CVE-2026-109619 on a fully patched PHP 8.2 host; according to them, the patch solved the issue for state consumers but not for the producer. The mechanism that tracks uploads still writes the file name under an attacker-specified identifier, which argues for disabling this mechanism altogether.
watchTower reports having managed to reproduce the CVE-2026-109618 flaw. CrowdStrike also claims a functional PoC remains reliable despite worker restarts. On ARM, it bypasses ASLR (address space layout randomization) using HTTP requests alone.
JFrog makes the same assertion about functional PoCs. It cautions, however, that fake PoCs are circulating as pranks or as efforts to spread misinformation by malicious actors taking advantage of the confusion.
ESET has observed exploitation attempts but “still limited.” It mentions scanning activity but no widespread or significant compromise at this stage.
Edge devices also face vulnerabilities
Many CERTs highlight the risk to gateways and other border devices.
At F5, BIG-IP affects two areas: the control-plane configuration utility and the APM/SSLO data plane. There is no fix yet.
Citrix, meanwhile, notes that the NetScaler management portal uses PHP across several interfaces and intends to roll out fixes on October 27.
Cisco lists two families of affected products. For URWB (Ultra-Reliable Wireless Backhaul) devices, a fix is planned for February 2027. For Expressway and Expressway Select gateways, the date remains to be determined.
Sophos catalogues a vulnerable component: the MyUTM portal. It is a hosted license management service for SG UTM firewalls, now end-of-life as of June 2026. Pending a fix, MyUTM has been taken offline.
For its DSM operating system, Synology has patched PHP up to version 7.4. It has released updates for two other affected packages: Mail Station and Synology Calendar.
QNAP reports around half a dozen affected products, starting with QTS. No fixes are available yet, but it recommends disabling the PHP server if it is not needed.
