Skip to content
Critical PHP Vulnerabilities Disclosed with Unauthenticated RCE Risk

Critical PHP Vulnerabilities Disclosed with Unauthenticated RCE Risk

First seen 22 Oct 2026, 01:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 01:38 UTC
  • •Two critical PHP vulnerabilities disclosed with CVSS score of 9.2.
  • •Vulnerabilities allow unauthenticated remote code execution on default configurations.
  • •Chainguard released patched images for PHP versions 8.2 to 8.5.

On October 21, 2026, Chainguard disclosed two critical PHP vulnerabilities with a CVSS score of 9.2, allowing unauthenticated remote code execution (RCE) on default configurations. The vulnerabilities affect PHP versions 8.2, 8.3, 8.4, and 8.5. In response, Chainguard released patched container images for these versions to help users mitigate the risks quickly. However, Chainguard broke the embargo by publishing the fixes six hours before the coordinated release, leading to criticism from the security community. The vulnerabilities are significant as they could potentially be exploited by attackers to gain unauthorized access to systems running vulnerable PHP versions. As of now, the vulnerabilities have been disclosed but there is no confirmation of in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Critical PHP vulnerabilities disclosed
Chainguard announced two critical vulnerabilities in PHP allowing unauthenticated RCE, affecting versions 8.2 to 8.5.
Chainguard
2026-10-21
Chainguard breaks embargo
Chainguard published patched images six hours before the coordinated release, leading to community backlash.
Chainguard
2026-10-22
Patched images made available
Chainguard made free container images for PHP versions 8.2, 8.3, 8.4, and 8.5 available to users.
Chainguard

More articles in this cluster (2)

Extracted Entities (2)

1 / 2

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions 8.2, 8.3, 8.4, and 8.5.
Is there any active exploitation reported?
No active exploitation has been confirmed as of now.
What should I do to protect my systems?
Update to the patched container images provided by Chainguard as soon as possible.