Skip to content
Critical PHP Vulnerabilities Exploited Before Disclosure

Critical PHP Vulnerabilities Exploited Before Disclosure

First seen 28 Oct 2026, 14:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:11 UTC
  • •Two critical vulnerabilities in PHP with CVSS scores of 9.2 each were disclosed on October 21, 2026.
  • •Active exploitation was confirmed within hours of disclosure, with attempts noted as early as October 17.
  • •Over 32.5 million PHP services are potentially vulnerable, emphasizing the need for improved identity management.

Two critical vulnerabilities (CVSS 9.2) in PHP were discovered and within hours of their disclosure on October 21, 2026. The vulnerabilities, present since 2012, affect all PHP installations serving web requests. Attack attempts were observed as early as October 17, four days before the patch was released. With 32.5 million internet-facing PHP services potentially vulnerable, the exploitation gap is widening as remediation efforts lag behind. Security teams are urged to focus on identity management to mitigate risks from compromised workloads. The vulnerabilities were identified by researchers from Calif and Wiz, with assistance from AI models from OpenAI and Google. CISA has added these flaws to its list of known exploited vulnerabilities as of October 26, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
First exploitation attempts observed
Attackers began targeting the vulnerabilities in PHP before the public disclosure.
BleepingComputer
2026-10-21
Patch released for vulnerabilities
PHP released a patch addressing the two critical vulnerabilities discovered by researchers.
BleepingComputer
2026-10-26
CISA adds vulnerabilities to KEV list
CISA confirmed the addition of the two PHP vulnerabilities to its list of known exploited vulnerabilities.
BleepingComputer

More articles in this cluster (2)

Extracted Entities (3)

1 / 2

Common questions

What are the CVSS scores of the vulnerabilities?
The vulnerabilities have a CVSS score of 9.2 each, indicating critical severity.
How many PHP services are affected?
Approximately 32.5 million internet-facing PHP services are potentially vulnerable.
What should security teams focus on?
Security teams should prioritize identity management to limit the impact of potential exploitation.