Am I Affected?
If your server runs PHP and handles web requests, you are likely affected. The vulnerabilities impact all common deployment configurations:
- PHP-FPM (the most common production setup)
- Apache with mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
Palo Alto Networks has identified over 22.6 million exposed instances potentially vulnerable to these flaws. Cloudflare has confirmed active attack traffic targeting these vulnerabilities.
What To Do
Update PHP to a patched version immediately, prioritising internet-facing systems. The UK National Cyber Security Centre (NCSC) advises immediate action.
| PHP Branch | Patched Version | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported |
| PHP 8.4 | 8.4.27 | Supported |
| PHP 8.3 | 8.3.36 | Supported |
| PHP 8.2 | 8.2.35 | Supported |
| PHP 7.4 – 8.1 | Source backports | End-of-life — manual build required |
Running Legacy PHP?
If your system runs PHP 7.4 or earlier, the official patches are source backports only — meaning you need to compile PHP yourself. There are no pre-built packages for end-of-life versions.
This is exactly the situation we help with. PHP Experts specialises in upgrading legacy PHP systems to supported versions safely, without breaking production. If you are running end-of-life PHP and cannot patch, contact us for emergency upgrade assistance.
Timeline
- Before 21 October 2026 — Vulnerability details leaked ahead of coordinated disclosure
- 21 October 2026 — PHP releases patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35)
- 21 October 2026 — Cloudflare reports active attack traffic
- 21 October 2026 — UK NCSC issues advisory