PHP: The latest news in the PHP world

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

2026-10-21T13:48:38+00:00

More information here: https://www.php.net/archive/2026.php#2026-10-21-5

This is brutal:

PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

submitted by /u/dyler_turten
[link] [comments]

Weekly help thread

2026-10-19T06:00:10+00:00

Hey there!

This subreddit isn't meant for help threads, though there's one exception to the rule: in this thread you can ask anything you want PHP related, someone will probably be able to help you out!

submitted by /u/brendt_gd
[link] [comments]

Has PHP2Shell borne fruit?

2026-10-22T12:40:19+00:00

Apologies if this a stupid question. Do we know of any websites that have actually been infiltrated using these vulnerabilities yet? (not attempts, not probing, not websites pre-emptively taken down by their owners). This isn't an attempt to downplay the problem, I've just been struck by its absence in any of the reporting, which sometimes conflates, at least in clickbait headlines, websites being pulled as a precaution with them being down due to attack.

submitted by /u/AsparagusFull4644
[link] [comments]

This week's PHP CVEs showed how far behind our old repos are

2026-10-23T08:36:58+00:00

I work at a small agency and we still look after 14 client sites we built years ago. When the CVEs dropped on Tuesday I spent two nights patching, and 5 of the 14 were still on PHP 7.x. One was on 5.6. Nobody had touched them since launch because nobody was paying for maintenance.

The first night was all bandages. WAF rules to block the multipart stuff, smaller header limits, and hoping. Proper upgrades on the 7.x ones took the rest of the week and we're still not done with the 5.6 one.

What bothers me is that the vulnerabilities were found by AI tooling, so I don't think this is the last one this year. After this we turned on Coderabbit's security scan across all 14 repos, so at least the next problem shows up as a PR instead of a phone call at 1am. It doesn't fix the fact that half of them are on versions nobody wants to touch though.

For people with old client projects, how are you handling maintenance now? Do you charge for it upfront, drop clients who won't pay, or just eat the nights like this one?

submitted by /u/No_Computer_1013
[link] [comments]

Someone Knew About PHP's Critical Flaws Four Days Before the Public Did and Amazon Can't Explain How

2026-10-22T16:28:45+00:00

submitted by /u/No_Picture_925
[link] [comments]

Hats off to Ondřej Surý

2026-10-21T19:31:12+00:00

I found out about this at 2 am. I'm a sole maintainer, have a full schedule today, and the fix couldn’t wait. Ubuntu servers. I had everything updated by 3 am.

Ondřej will save the internet today.

I’ve got one legacy website running on a system that needs PHP 7.4. It’s not a situation I’ve been comfortable with for a while, but some constraints are what they are. The fact that Ondřej’s repositories had security updates backported all the way to PHP 7.4 absolutely saved my ass.

What a fucking hero.

submitted by /u/Suncoast_Stoked
[link] [comments]

Regarding PHP security that were discovered 2 days ago

2026-10-23T03:57:12+00:00

My question is about the PHP security exploits that were discovered yesterday. I heard the issue was fixed a day ago meaning yesterday. I am not very familiar with cybersecurity and things like that, but as a regular user right now browsing sites like SourceForge and regular websites, is it totally fine for me to use them, browse normally, and download things, or is there still any danger and the issue hasn't been 100% resolved?

submitted by /u/No_Gene_5656
[link] [comments]

Here's what happened with Chain Security

2026-10-22T11:37:12+00:00

Just in case you missed it, here's what happened from the ChainSecurity side.

This is what Dan Lorenc from Chain Security shared on LinkedIn.

I wanted to share what happened with the PHP embargo, our role in it, and my decision process last night to ship the fixed builds early. First of all, the PHP Foundation and maintainers did an amazing job here in a high stress situation. I'm sorry that my decision led to even more stress for them.

We first got read in that there was something coming up in PHP last Friday by one of the original researchers that discovered this issue. That night we were able to independently discover the same issue using our harness and a frontier model with a basic prompt of "find bad vulnerabilities in PHP".

We got fully read in Saturday and confirmed that some our findings matched those from the initial report, and worked to help test the fixes.

Monday news started to leak, and we followed along in the coordinated disclosure channel. Tuesday night the gossip picked up even more, and several of the other security vendors in the process confirmed seeing exploits in the wild.

After talking to several of the other researchers on a video call, I made the call to ship the fixes and immediately notified the group, following the coordinated vulnerability disclosure process's guidelines for releasing after evidence of exploits in the wild. This decision was based on how easily we were able to independently discover the vulnerability and build an exploit, how much information was already out there on the coming vulnerabilities and fixes, and the evidence shared on active exploits in the wild.

We published built artifacts and made them publicly accessible for anyone - not just our customers - late last night Eastern Time. This morning the PHP Foundation released their statement, and obviously didn't agree with my decision. This stuff sucks, and vulnerability disclosure for vulnerabilities like this rarely goes smoothly.

We're all on one team here, trying to minimize harm on end users from attacks. We're working through hundreds of disclosures just like this one every day, and have been for the last three months, both for vulnerabilities we've discovered on our own and with partners. Our policy for all of these is and has been to do what helps protect the most people. I wrote about this a few months ago on our blog.

We're not always going to get it right, and not everyone is going to agree with our decisions, but that is always our goal.

This is unfortunately the new normal for the industry, and we're going to need to work together as one team to have a chance at securing our critical infrastructure fast enough to stop attackers from causing real harm.

https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_/

Edit. Just to clarify I'm just some dude sharing the LinkedIn post for discussion

submitted by /u/BeyondLimits99
[link] [comments]

PHP2Shell in the wild: the first 48 hours on a honeypot fleet

2026-10-22T12:59:25+00:00

submitted by /u/ThreatRadar
[link] [comments]

PHP critical RCE release (8.4.27): what should website owners actually do right now?

2026-10-23T04:42:41+00:00

I run websites on PHP (WordPress/custom PHP, shared hosting/VPS). I saw the PHP Foundation’s post about the Oct 21 security release (8.4.27) fixing two critical RCE vulnerabilities, with updating as the only fix.

As a website owner, what should I do right now?

a). How do I confirm my server is affected and whether my host has patched it?

b). What’s the safest order: backup, update PHP, then check logs for exploit attempts?

c). Any temporary protection (WAF rules, disabling extensions) until the update is done?

submitted by /u/dark_devil307
[link] [comments]

GitHub Action setup-php builds updated for the PHP security releases, including EOL versions

2026-10-22T12:29:01+00:00

Updated builds addressing CVE-2026-109618 and CVE-2026-109619 are now available through setup-php for PHP 5.3–8.7 on Linux, macOS and Windows, including backports for EOL versions for use in CI.

See - https://setup-php.com/php-october-2026-security-releases

Also, for local installations.

MacOS: https://github.com/shivammathur/homebrew-php
Windows:
Official Packages (PHP 8.2 to PHP 8.5): https://www.php.net/downloads.php?os=windows
Builds for setup-php (PHP 5.3 to PHP 8.7): https://github.com/shivammathur/php-builder-windows/releases

If you would like to DIY a build for EOL versions, you can find security backported patches including the ones for these CVEs here: https://github.com/shivammathur/php-src-backports

submitted by /u/shivammathur
[link] [comments]

your AI-built app is probably fine. the old server next to it might not be (php2shell + node, oct 21)

2026-10-23T07:28:14+00:00

submitted by /u/arsm2016
[link] [comments]

Sponsor Ondřej Surý

2026-10-21T20:10:31+00:00

Service Reminder: Don't forget to sponsor Ondřej Surý for his great work on PHP packaging. Hours before FrankenPHP, he was ready.

It even seems that he backported the patch to some old PHP versions – i saw a change in the php 5.6 (!) packages.

Ondřej, if you read this: Thank you so much.

submitted by /u/ubhz-ch
[link] [comments]

PHP2shell (CVE-2026-109618, CVE-2026-109619): what's known so far, and how to work out which PHP version you're actually exposing

2026-10-23T08:33:42+00:00

Quick summary for anyone still sorting through this: → There are 2 RCEs in PHP core, not in an app or framework. Each is CVSS 4.0: 9.2. They were disclosed October 20, and PHP's fix was scheduled for October 21 at 14:00 UTC. → Sansec reports PHP 5.4 and later is affected. An exploit-tool screenshot circulating claims it works from 5.4.0 onward, but that hasn't been verified. → PHP upstream supports only 8.2 and later. If you run 8.1 or older, no official fix is coming, so you'll need distro backports, an upgrade, or compensating controls. Interim mitigations that have been floated (stopgaps, not fixes): → Sansec: session.upload_progress.enabled = 0 and session.use_strict_mode = 1 in http(:)//php(.)ini → Syhunt's php2shell-protection kit: a web server or WAF rule that rejects multipart/form-data POSTs before they reach PHP

For inventory, the fastest answer is still php -v on the box. If you need an outside-in view of many domains, the usual passive signals are the X-Powered-By and Server headers, a 404 response, the PHPSESSID cookie, and the old easter-egg URL (only PHP older than 5.5 answers it). A lot of servers hide all of this, so "no version found" doesn't mean "not affected." Check Exposure: https://hubs.la/Q04BVKGy0

submitted by /u/socradario
[link] [comments]

What happened to CRUDBooster? I created a community fork to help keep it alive

2026-10-23T00:54:45+00:00

I’m not sure how many Laravel developers here remember CRUDBooster from around 2019, but it was a pretty popular tool for quickly building admin panels and CRUD applications.

I have several projects built with CRUDBooster, so I was concerned to see that the original project’s maintenance and newer versions have moved in a different direction. For those of us still maintaining older applications, migrating to a completely different version or framework can be a challenge.

I’ve created a community fork here:

👉 https://github.com/vicheanath/crudbooster-contrib

My goal is to help preserve the legacy codebase, keep existing projects maintainable, and explore fixes for compatibility and security issues as PHP and Laravel continue to evolve.

I’ve also seen discussions about newer PHP security vulnerabilities, which makes me wonder how we can keep older CRUDBooster applications safe and usable.

I’d love to hear from the community:

Is anyone still using CRUDBooster in production?
Are you maintaining existing projects built with the older version?
Would a community-maintained fork with security patches, bug fixes, and compatibility updates be useful?
Would anyone be interested in contributing?

I know maintaining an open-source project takes time, and I can’t promise to support every version or fix every issue. But I’d like to see whether there’s enough interest to keep this project useful for developers who still depend on it.

If you have experience with CRUDBooster, I’d love to hear your thoughts!

submitted by /u/Valuable_Resist_8569
[link] [comments]

PHP2Shell is already being exploited: probing started 5.5h before 8.2.35/8.3.36/8.4.27/8.5.12 shipped, patch now

2026-10-21T21:25:15+00:00

submitted by /u/HexLayer3
[link] [comments]

Todays drama showed how important PHP is

2026-10-21T18:14:43+00:00

From government websites around the world to banks, schools, social media, video game companies, news organizations. They either shut down or made statements about getting the patch. Edit: even the prime minister of Japan made an official statement about this incident. Crazy stuff

if php was truly dead this vulnerability would have gone mostly unnoticed but everyone is talking about it. Even people that are not programmers.

”PHP is dead. How even uses php in 2026”, well like half the internet.

submitted by /u/rafark
[link] [comments]

There are many sites where the administrators stopped performing updates, even after critical issues were discovered in PHP—does that mean those sites will eventually become inaccessible?

2026-10-23T02:05:23+00:00

I know of many sites that I relied on heavily, but which were abandoned by their administrators long ago. Now, following the recent PHP-related issues, whenever I try to open them, I’m met with warning messages. Are all these sites—and there are so many of them—simply destined to be left behind for good? There are still so many I’d love to keep using :<

submitted by /u/aaakkahs
[link] [comments]

php2shell: version-checking misses most vulnerable hosts — here's a crash-based checker instead

2026-10-22T13:24:15+00:00

Quick take after watching the php2shell (CVE-2026-109618/109619) coverage this week: almost every "are you vulnerable?" check I've seen just reads the X-Powered-By version. That's close to useless, because expose_php=Off is the default on a lot of production setups - roughly 4 in 5 PHP servers don't advertise a version at all. So a version check comes back "unknown" or "looks fine" on the exact hosts you most want to know about.

Since the actual bug is a crash primitive (the OOM/longjmp bailout leaving request state half-initialized), I built a checker that triggers it instead of guessing: it sends a crafted multipart probe and only reports VULNERABLE if the engine actually returns the PHP memory-exhaustion fatal error. Banner-independent. Returns FIXED / VULNERABLE / NO SIGNAL (no-signal = it couldn't crash it and the host hid its version, so it won't pretend to know).

One caveat worth repeating: only run it against servers you control. It sends memory-exhaustion probes that can briefly take out a worker.

Checker: https://o3.security/tools/php2shell-scanner

Disclosure: I work at O3 Security and we built this. There's a longer write-up on the mechanism if you want it — the SAPI differences (mod_php is the worst case because it runs shutdown even on a failed request startup), and the genuinely counterintuitive bit where capping memory with RLIMIT_AS as a "mitigation" actually makes the bug *easier* to hit: https://o3.security/blog/php2shell-cve-2026-109618-109619-analysis

Curious if anyone here has seen the version-banner problem bite them in practice — how are you all confirming patch status across a fleet where half the hosts don't report a version?

submitted by /u/Cheap-Guide-3955
[link] [comments]

Today's PHP Security Release, and How We're Strengthening PHP Security

2026-10-21T14:52:58+00:00

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work.

submitted by /u/elizabethn
[link] [comments]

I made a free VS Code extension that fixes your namespaces when you move a PHP file

2026-10-23T03:12:02+00:00

Move or rename a PHP file in VS Code and the namespace and use lines don't follow. This fixes that. Drag the file or folder, and the namespace, class name and every use line in your project update.

It's a rebuild of PHP Namespace Resolver, so the old commands and settings still work, and the CPU freeze is fixed.

Free and open source. Search "PHP Namespace Mover" in VS Code extensions, or Open VSX if you use Cursor or Windsurf.

https://github.com/lagudafuadtosin/php-namespace-mover

submitted by /u/Fuad_Laguda
[link] [comments]

PHP2Shell - what do we do now?

2026-10-23T06:32:52+00:00

It is super important to run checks on the servers now while logs still exist and some forensic data is still available. I was a bit surprised to read https://offseq.com/en/research/php2shell-first-48-hours/

Curious what everyone is doing after the exploit? What logs are you checking? What are you locking down?

I, aka Claude, made a small check for my instance. Maybe it will help you check as well? Feel free to change or use as needed. Licensed under our overlord-is-claude license. Aka, WTFPL.

https://gist.github.com/cgsmith/6e09d68027f17ae289cbc9ba2abc3309

submitted by /u/cgsmith105
[link] [comments]

New PHP CVE discovered ?

2026-10-21T20:46:31+00:00

Hello,

Apparently 8.5.12 still has a new CVE that the user has apparently reported.

https://mastodon.gougere.fr/@elise@katze.sh/117479383706597320

Nothing confirmed, but maybe ?

EDIT : IluTov answered just below.
https://www.reddit.com/r/PHP/comments/1xbyxd2/comment/19rga18s433qd/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

submitted by /u/ReiTW_
[link] [comments]

Is it just me, or is it taking a concerning amount of time for the docker php updates to build and publish?

2026-10-21T15:05:34+00:00

For what is looking like ‘the worst set of vulns in history’, I find it a bit baffling that the docker builds are still in progress - an hour after the patches have been released. Seemingly all because we’re all waiting on GitHub actions… I bet half of us here have a pc and internet connection that could have built and pushed the containers 45 minutes ago

submitted by /u/selexin_
[link] [comments]

And now you get this XKCD comic

2026-10-21T20:39:00+00:00

submitted by /u/CAPICINC
[link] [comments]