Critical PHP Vulnerabilities Exploited in Active Attacks

The U.S. cybersecurity agency has confirmed active exploitation of two recently patched PHP vulnerabilities, adding them to its Known Exploited Vulnerabilities catalog. Both flaws enable unauthenticated remote code execution and score 9.2 on the CVSS severity scale. One stems from memory corruption, the other from improper handling of internal request state. Patches became available on October 21 across PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

A security researcher demonstrated working exploitation against honeypot systems on October 24, proving attackers can extract memory and leverage the leaked data to build functional payloads. The attack produced an 800-kilobyte memory dump. Federal agencies must apply patches by October 29.

The scope is broad: PHP powers roughly 70% of all websites globally, with over 32.51 million services still running vulnerable versions. The impact extends across numerous major vendors. In parallel, the PHP Foundation patched a critical flaw in the Brotli decompression library affecting Windows builds when response decompression is enabled in curl.