php admins: patch this one now

php put out emergency security releases today for two bugs that can allow unauthenticated RCE. fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

the ugly part: PHP says every install serving web requests is at risk. that includes FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. mod_php is considered the highest risk. there is no complete workaround.

if your distro packages are not showing up yet, check its security repo or advisory. do not swap a distro build for some random tarball just to make the version number move. PHP 8.1 and older need a vendor backport or an upgrade, though upstream posted minimal source backports for 7.4 through 8.1.

source and details: https://rootbadger.com/shortened/tbzdrepoz

after updating, check what is actually running. it is easy to patch the host and miss a container or old worker.

In article 56d74783-6429-411d-9c72-e9993f9c308a@rootbadger.com, Ghostline ghostline@shadowbyte.dev wrote:

Allowed running commands on the server. nasty

--
Tom Mix

update: the exploit traffic is here, but "down" does not automatically mean "hacked."

Cloudflare says it saw thousands of attempts before disclosure, tens of
thousands within 45 minutes, hundreds of thousands within two hours, and
millions after that. Amazon says its sensors saw attempts as early as October
17. Public proof-of-concept code is circulating.

what has actually been owned? as of Friday morning, CISA and the BBC still had no confirmed successful compromise to name. There is no honest victim list yet. That does not mean nobody got in; it means scanning and exploit attempts are confirmed, while public attribution of a successful intrusion is not.

who went down or cut services as a precaution:

• Wikimedia disabled some supporting systems.
• government sites in Finland, France, Denmark and the Netherlands were pulled; the Dutch cyber-security agency took its own site offline.
• the UK took 32 smaller government sites down, and Edinburgh council and some BBC pages were affected.
• Orange suspended access to some services globally.
• SoftBank paused Japanese earthquake and tsunami emergency alerts until Monday.
• ANA, JR West and MUFG temporarily suspended some pages or services.
• The Journal in Ireland, Something Awful and 4chan also went offline while patching.

so the confirmed story is massive hostile probing plus a long list of defensive shutdowns, not a verified global breach list.

one more wrinkle: CERT-EU now lists a third RCE, CVE-2026-115560. PHP calls it an unlikely configuration-dependent risk and is not doing another out-of-band release. Their temporary advice is to disable session upload progress and restart every worker until the next regular fix.

patch levels remain 8.5.12, 8.4.27, 8.3.36 and 8.2.35. After updating, restart FPM/Apache/LiteSpeed workers, then check containers, appliances and old management panels too. A patched CLI binary proves almost nothing about the worker serving requests.

sources:
CISA alert:
https://rootbadger.com/shortened/4kcnrllhm

BBC status roundup:
https://rootbadger.com/shortened/u1ptrctml

Guardian exploit-traffic report:
https://rootbadger.com/shortened/pecfno5go

CERT-EU technical advisory:
https://rootbadger.com/shortened/1hme6hxkh