Critical PHP Security Issue 10/21/2026

What Happened

Yesterday, the PHP security team announced (opens in a new tab) a critical vulnerability that appears to be present in all versions of PHP going back to version 5.4. The vulnerability creates a pathway for remote code execution, allowing webshells to be opened on the remote host.

Patch Timing

PHP will be releasing patches this morning (10/21/2026) at 10AM EST to fix the bug that allows the RCE. Initial reports indicated that only version 8 distributions would be getting the patch, but there are signs this morning that a third-party might be releasing fixes going back to PHP version 5.6.

How to Protect Your Servers

Permanent Fix

Patch PHP

The only real permanent fix is to patch PHP to an updated version, closing the hole.

Until the Fix Is Available

Adjust php.ini

Until the fix is available, some mitigation may be possible by making adjustments to the php.ini configuration file on the server. DataYard has already taken this step for customers with known PHP installations. See the article “PHP-UP-2026 (opens in a new tab)” in the resources below for the recommended php.ini adjustment.

Cloudflare Users

New WAF Rules

Thankfully, Cloudflare just announced (opens in a new tab) that they’ve released new WAF rules to block the threat, and that they’ve made it available to all users using their service. This only applies if the site is PROXIED through Cloudflare.

See the resources below for additional information.

Resources

  1. “Upcoming Critical PHP Security Release” (opens in a new tab) php.net
  2. “PHP Ships Two Critical Fixes Tomorrow. Here’s the Night Before” (opens in a new tab) codykretsinger.com
  3. “PHP-UP-2026” (opens in a new tab) jackalsyn.com
  4. “WAF Release – 2026-10-21 – Emergency – Cloudflare Managed Ruleset” (opens in a new tab) developers.cloudflare.com

Check out our other blogs

View All