Summary
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
- Vendor
- PHP Group
- Product
- PHP
- Added to KEV
- Oct 26, 2026
- Remediation due
- Oct 29, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
- EPSS
- 100.0% as of Nov 12
In the news · last mention Nov 12
- PHP2Shell Exploitation on Check Point Gateway
- PHP major vulnerability triggers cybersecurity alert! AI attack and defense business opportunities attract attention, domestic only cybersecurity ETF rose over 10% in a week ZH
- 26th October – Threat Intelligence Report
- Two critical vulnerabilities in PHP have been patched VI
Linked
Actors named alongside it:
Incidents exploiting it:
References