Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. PHP is a widely-used, open-source server-side scripting language designed primarily for web development. All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are considered at risk. Successful exploitation of the most severe of these vulnerabilities could allow for unauthenticated remote code execution in the context of the affected service account. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.

While there are currently no reports of these vulnerabilities being exploited in the wild, the potential for exploitation is a high risk. It is expected that exploits for these vulnerabilities will be present in the wild very quickly.

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. Details of these vulnerabilities are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of the most severe of these vulnerabilities could allow for unauthenticated remote code execution in the context of the affected service account. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®