PHP Security Patch Update: Known Regressions

This incident has been resolved.

PHP RCE Advisory (CVE-2026-115560)

Following the PHP Group’s latest security advisory (https://www.php.net/archive/2026.php#2026-10-23-1), the configuration-dependent remote code execution (RCE) issue highlighted in our previous update has now been assigned CVE-2026-115560.

As reflected in our previous update, our Security team had proactively anticipated this vulnerability and implemented mitigations before the vulnerability was formally disclosed. The mitigations already in place align with the recommendations in the PHP Group’s latest advisory. Customers continue to be protected against the new CVE-2026-115560. No action is required from customers at this time.

We continue to monitor developments and will adapt our protections as needed.

We are aware of the reports highlighting regressions in a few of the recent official PHP security patches. The official PHP Group has not yet published an official position or updated patches addressing these reports. Mitigations remain in place to protect customers against the currently known attack paths, and we continue to monitor for further developments. No action is required from customers at this time.

The currently known regressions are:

1. Configuration-dependent RCE: A reported RCE demonstration affects PHP 8.5.12 (which may possibly affect earlier versions as well) under specific configurations. We have implemented mitigations that break the demonstrated exploit chain. Our customers remain protected against this specific attack path.

2. Memory-safety Regression: A separate, verified bug report identifies a potential double-free issue affecting PHP 8.4.27 and 8.5.12, which may cause crashes under specific conditions. This is currently a stability and memory-safety concern, not a critical security issue (e.g., remote code execution).

We are monitoring the situation and will continue to respond quickly to new vulnerability details or attack techniques as they emerge. If you have any questions, please reach out to our support team.