PHP flaw allows remote code execution; exploited in the wild

What happened

PHP keeps some global state that briefly refers to memory belonging to an individual request. Under certain conditions this state is not properly cleared, or is filled again after being cleared, so it can still point to request memory that has already been released. A later request may then read or act on this outdated state before it has been set up correctly. This is a use-after-free type of weakness, and it can be triggered in more than one way to achieve remote code execution.

The flaw was published on 2026-10-21. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-26, meaning it is being exploited in the wild. Cisco and Fortinet have published advisories about how it affects their products.

Who is affected

The vendor is the PHP Group. Affected PHP releases are 5.4.0 up to but not including 8.2.35, 8.3.0 up to but not including 8.3.36, 8.4.0 up to but not including 8.4.27, and 8.5.0 up to but not including 8.5.12.

The flaw also reaches products that include PHP, among them Palo Alto Networks PAN-OS and Panorama virtual appliance, and Siemens Energy Engage, Spectrum Power and AMIS TS, along with other software that bundles it. Cisco (advisory cisco-sa-php-october26-Jj384Daq) and Fortinet (advisory FG-IR-26-186) have also issued advisories, but neither says in the data available to us which fixes apply to their products.

How serious is it

PHP's security team scored the flaw 9.2 under CVSS 4.0, which is critical. According to the vector, it can be attacked over the network without credentials or user interaction, although attack complexity is rated high and certain preconditions must be present. A successful attack can fully compromise confidentiality, integrity and availability of the affected system.

The CISA KEV listing confirms active exploitation. The EPSS score, an estimate of how likely exploitation is, stands at 0.99999. CISA set a remediation due date of 2026-10-29 for US federal agencies.

What you should do

1. 1Update PHP to a release outside the affected ranges listed in the PHP security advisory.
2. 2Identify appliances and applications that bundle PHP, including PAN-OS, Panorama and Siemens products, and apply their vendors' guidance.
3. 3Review Cisco advisory cisco-sa-php-october26-Jj384Daq and Fortinet advisory FG-IR-26-186 for affected products and mitigations.
4. 4Apply vendor mitigations as CISA directs, and stop using a product if no mitigations are available.
5. 5Check internet-facing PHP systems for signs of compromise and monitor vendors for further updates.

Quick facts