PHP Issues Emergency Patches for Two Critical RCEs

PHP ships out-of-band patches today at 14:00 UTC for two critical remote code execution vulnerabilities. Full technical details are withheld until the builds land. PHP posted the advisory to php.net on October 20, noting it would release “earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

The flaws were discovered and reported by watchTowr under coordinated disclosure. watchTowr CEO Benjamin Harris led the research. CVE IDs have been assigned but have not yet propagated to NVD or MITRE as of this writing.

Confirmed. CVSS v4.0 score of 9.2 per PHP’s own rating. Patches target PHP 8.2, 8.3, 8.4, and 8.5 only.

Unconfirmed, treat accordingly. A now-deleted Hacker News post by “petecooper” that surfaced the night of October 20 claimed CVSS 10.0 and reported the flaws reach all PHP versions back to PHP 5. watchTowr’s FAQ explicitly called the version-scope claim unconfirmed. PHP’s advisory has not addressed it. Use the official 9.2 until PHP or watchTowr say otherwise.

Exploitation status. No active exploitation confirmed at time of writing. Huntress reports no PoC reproduction. CISA has not added these to the KEV catalog. Analysis: a 9.2 CVSS RCE in the PHP runtime has historically had a short window between patch release and active exploitation when the flaw class is broadly reachable. Status is expected to change once watchTowr publishes technical details.

The original coordinated-disclosure window was set for October 22. The HN post moved the timeline. PHP accelerated the out-of-band release by one day in response.

Remediation. Fixed versions for PHP 8.2, 8.3, 8.4, and 8.5 are expected at 14:00 UTC. PHP 8.1, 8.0, 7.x, and 5.x will not receive fixes. watchTowr has said technical details go out after the patch ships.

PHP runs on roughly three-quarters of all websites with a known server-side language, including WordPress, Drupal, Joomla, and the majority of shared hosting stacks. A critical RCE in the runtime reaches all of those installs at once, not just one plugin or one application. Compare last week’s Next.js out-of-band RCE patches, which hit a narrower but still widely deployed surface.

More when watchTowr publishes and CISA updates status.