Skip to content
Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution

Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution

First seen 22 Oct 2026, 18:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 19:44 UTC
  • •Two critical PHP vulnerabilities (CVSS 9.2) allow unauthenticated remote code execution.
  • •Patching is required for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
  • •Astra's tools are detecting these vulnerabilities across customer environments.

Two critical vulnerabilities in PHP, both rated CVSS 9.2, allow unauthenticated remote code execution without requiring credentials. The flaws affect the PHP core, impacting a significant portion of the internet, as PHP powers around 70% of web applications. Patches have been released for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Astra's Autonomous Pentest and DAST tools are already detecting these vulnerabilities in customer environments, emphasizing the urgency for administrators to update their systems. The vulnerabilities pose a serious risk, as they can be exploited without any authentication, making them particularly dangerous for web applications relying on PHP.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
Critical vulnerabilities disclosed
Two critical PHP vulnerabilities were disclosed, allowing unauthenticated remote code execution.
Linkedin
2026-10-22
Emergency patches released
Emergency patches for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 were released to address the vulnerabilities.
Facebook

More articles in this cluster (2)

Extracted Entities (2)

1 / 2

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
What should I do to protect my systems?
Administrators should apply the emergency patches released for the affected PHP versions immediately.
Is there evidence of exploitation in the wild?
Currently, there is no confirmed exploitation reported, but the vulnerabilities are critical.