Special edition: Leaked PHP RCE bugs bring fixes forward to 03:00 NZDT Thursday

Kia ora, this is a special edition of It's Probably Nothing. Two PHP vulnerabilities that were meant to stay quiet until Thursday have had their existence leaked, and PHP has reportedly moved its fix forward. As of about nine in the evening UTC on Tuesday the twentieth of October, nobody outside the embargo knows what's actually broken, which hasn't stopped anyone arguing about how bad it is.

First, housekeeping. If you've seen this tagged with the year 2926, that looks like a typo in watchTowr's own post on X. Everyone else is using the 2026 identifiers, and nobody's issuing CVEs for the year 2926 just yet.

Now the substance. Around 15:20 UTC on the twentieth, according to Cyber Kendra, a Hacker News user posted claiming two CVSS 10 PHP remote code execution bugs, affecting PHP 5 onwards, were due out on the twenty-second. The post cited a reliable source, admitted it had no evidence, and has since been flagged. watchTowr then said the leak was genuine, that these are real RCE zero-days, and that the embargo was meant to hold until Thursday the twenty-second at 11:00 Eastern.

Cyber Kendra, and Mezha relaying BleepingComputer, both report that the PHP security team then put out an advance notice. It schedules a security release for Wednesday the twenty-first at 14:00 UTC. That's 3am Thursday New Zealand daylight time, and 1am Thursday in Sydney and Melbourne. As quoted, PHP says details and affected and fixed versions come with the release, and it may ship earlier if details go public or exploitation turns up. I haven't read that notice directly, and the cached php.net page doesn't show it yet.

The details are where it gets contested. PHP rates each flaw 9.2 under CVSS version 4. Per Cyber Kendra, PHP's notice doesn't name the CVEs or call them code execution bugs. That framing comes from watchTowr and the leak. watchTowr's CEO Benjamin Harris told BleepingComputer both are CVSS 10 and are understood to affect PHP 5, 6, 7 and 8. PHP 6 never shipped as a stable release, so I'd hold that list loosely. Florian Roth says it's an RCE in PHP core and that only PHP 8 will get patches.

watchTowr says it believes it's reproduced the first of the two bugs, has seen no exploitation in the wild, and knows of no workaround before the patch. Per Cyber Kendra, the CVE records are still reserved, and no affected function, extension or configuration has been named.

My read: this deserves real attention, with a side-eye at the CVSS 10 one-upmanship. A pre-patch leak in something as widely deployed as PHP core is unpleasant whether it scores 9.2 or 10. And if Roth's right about PHP 8 only, the long-dead PHP 5 and 7 boxes lurking on shared hosting and in forgotten corners become the real problem, because they'd get no official fix at all.

So, since the release lands in the small hours here, do the boring prep now. Find every PHP version you run, including in containers and on hosting you'd rather not think about. Current supported builds are 8.5.11, 8.4.26, 8.3.35 and 8.2.34, from the twenty-fourth of September, so anything older is already behind. Line up a change window for Thursday morning New Zealand and Australian time, and check whether your distro or hosting provider is shipping backports, because nothing from them was visible yet.

To be clear about where this stands: no patch, advisory text, affected-version list or technical detail was public, and no exploitation had been reported. I haven't read PHP's notice, watchTowr's posts or the CVE records directly, so this rests on secondary reporting. Severity and version scope stay disputed until PHP publishes, and when it does, we'll know whether this was something, or probably nothing.

Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat.