The PHP Vulnerability situation is crazy

The 21st of October 2026 was a fun day for the IT guys for sure. I'm one of them. Here's my insight.

It's one of a kind experience to wake up to the news, especially since it's a RCE (remote code execution) and then not even knowing how many servers I had running PHP that I'd have to patch.

The journey started with reading what I could that was already published. No PoCs to be found.

Then I wrote a shell script that would scan the entire host for PHP versions that were vulnerable, including recursively finding all containers and VMs. I found... a few.

I immediately ran the update and restarted the running processes.

After all apps ran the patched version, I wanted to investigate a little.

My PoC

With the help of my friend I put together a PoC that I ran against my apps. For obvious reasons I won't share it here, but basically it takes plenty of conditions being met before the RCE can be done. It's as easy as Log4shell (that one I also remember happening live).

Eventually I ran a post request that gave a remote command execution on a simple PHP file upload demo app off GitHub.

Didn't patch yet?

GO OFFLINE NOW and update the versions to the patched ones. Then test again, restart running processes to ensure no vulnerable code is still running.

And stop using php lmao if possible.

Was anything related to marCloud vulnerable?

We don't use php. But other apps I ran for other people did so I still enjoyed my time. :/

Have questions or need help?

Feel free to ask me anything on my discord server: https://discord.gg/yaftWcn