Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

Critical PHP remote code execution flaw already under attack

Original title: Major security alert: PHP vulenrable to critical RCE, attacks ongoing

Patchstackby Mart Virkus ()1 min read
Read at patchstack.com
Part of a story covered by 21 sourcesPHP issues emergency fixes for two critical php2shell flawsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.

Patchstack reports a critical PHP remote code execution flaw already being exploited after some details leaked the day before. It says the bug can let anyone take over WordPress, Drupal, Magento, Joomla and Laravel sites on a vulnerable PHP version. CERT-EU issued warning 2026-018. Patchstack calls the situation a developing story.

Unconfirmed: The alert is developing and does not name a CVE, affected PHP versions, or how exploitation works.

Key facts
  • The alert says essentially every PHP application on a vulnerable PHP version is affected.
  • No CVE identifier or affected PHP version numbers appear in the alert.
  • Patchstack says a PHP update is scheduled for October 21, 14:00 UTC.
Security assessment · AI, from the articleExploited in the wild

Impact: Remote code execution and takeover of PHP websites

ProductAffected
PHP—
WordPressall versions on vulnerable PHP
Drupalall versions on vulnerable PHP
Magentoall versions on vulnerable PHP
Joomlaall versions on vulnerable PHP
Laravelall versions on vulnerable PHP
What to do
  1. 1.Upgrade PHP when the scheduled October 21 update is available.
  2. 2.Treat PHP sites, including WordPress, Drupal, Magento, Joomla and Laravel, on vulnerable PHP as exposed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phprcewordpressdrupalmagentolaravel
Products
PHPWordPressDrupalMagentoJoomlaLaravel
Organizations
PatchstackCERT-EU

From the original article

1 min read at patchstack.com

A critical vulnerability has been found in PHP versions – allowing anyone to take over WordPress, Drupal, Magento, Joomla and Laravel websites. ⚠️ Currently only fix is to upgrade PHP version – update is scheduled for October 21, 14:00 UTCPatchstack will post live updates on our social accounts on Linkedin, Facebook and X. The critical […]

Patchstack

By Mart Virkus · patchstack.com

Read the full article at Patchstack

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.