Web services face confirmed attacks through critical PHP weaknesses
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, October 28th, 2026.
Internet-facing PHP systems are under active attack through two critical memory-safety weaknesses. Successful exploitation can allow an unauthenticated attacker to execute code on an affected server. Researchers reported working remote code execution, and the flaws were added to the US government’s known-exploited list. Security updates are available, while public proof-of-concept material makes prompt action more important.
PHP supports a substantial share of web applications, so every deployment serving web requests may need review. For leaders, unsupported versions and incomplete inventories can turn an emergency update into prolonged exposure. For defenders, Apache with mod_php faces the greatest stated risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed installations are also affected. There’s also a separate PHP issue that requires an uncommon configuration and application behavior. It doesn’t yet have a security update, but an interim mitigation is available. The wider lesson is that shared web technology can spread risk quickly across unrelated services. Inventory every web-facing PHP deployment, apply supported fixes immediately, and keep session upload progress disabled where the separate unpatched issue could apply.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
