WORLD WATCH · October 21, 2026 · RESEARCH
Two unauthenticated RCEs in PHP core
Two unauthenticated remote code execution flaws affect PHP core.
- Reported by
- Cisco Talos, Malware News
- Outlets reporting
- 2
- Category
- RESEARCH
- Newest report
- October 21, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Two unauthenticated RCEs affect PHP core.
- Flaws are exploitable before application code runs.
- Exposure may vary by PHP binary and configuration.
What happened
The report comes from Cisco Talos. Cisco Talos is tracking disclosure of two flaws in PHP core dubbed php2shell. Malware News also reports those flaws. The flaws allow exploitation by a plain HTTP request. Exploitation can occur before any application code runs. The flaws affect every PHP build since 5.4.
Why it matters
A single PHP binary may serve one or more applications. Different PHP binaries may load different configuration files. A public exposure may exist without a known application link. Not all PHP installations may be visible to one security team.
What to do
- Identify each PHP binary that serves a public endpoint.
- Check each configuration file loaded by those PHP binaries.
- Track exposure for each identified PHP installation against the disclosed flaws.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 21, 2026). This brief summarizes reporting by Cisco Talos, Malware News. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.