Glonce

PHP patches two remote code execution holes after disclosure leak

securityThe Glonce editorsSimon Willison🔥65Glonce rating65Impact70Novelty50Relevance72Surprise65Players40Credibility85

Simon Willison's link-blog post of 21 October 2026 carries a blunt warning: anyone running anything on PHP should upgrade. The day's updates, which cover the entire PHP 8.x line, address two remote code execution holes, and exploits have been circulating since the night before because of a leak in the coordinated disclosure process.

Willison relays the PHP Foundation's account of what went wrong. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0; the actual score is 9.2. No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.

The trouble did not stop there. Around 20:00 UTC, after the leak and the pre-announcement, Calif, one of the security firms that had reported the issues, mistakenly published a video. It showed Calif's proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. According to the PHP Foundation, the video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.

Willison also points to an article from the team that discovered the original vulnerability, which gives a more detailed timeline of the intended responsible disclosure. On August 19, 2026, Wiz Research discovered the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. On August 20, unauthenticated RCE was confirmed against Drupal, and on August 21 against WordPress. Wiz Research reported the vulnerabilities to the PHP security team on August 24. PHP acknowledged the reports and began developing a coordinated fix on September 21. Patched PHP releases and public disclosure both landed on October 21.

Key facts

  • Updates across the entire PHP 8.x line fix two remote code execution holes; Willison says anyone running anything on PHP should upgrade.
  • The two CVE IDs leaked on October 20th at around 15:00 UTC with a wrong CVSS score of 10.0; the actual score is 9.2. The PHP Foundation says no technical details leaked.
  • PHP brought its pre-announcement forward to 19:30 UTC and moved the release from October 22nd to October 21st, 14:00 UTC.
  • Calif, one of the reporting security firms, mistakenly published a video of its proof of concept around 20:00 UTC; copies circulated and PoC development accelerated.
  • Wiz Research found the first vulnerability on August 19, 2026 using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, and confirmed unauthenticated RCE against Drupal and WordPress within two days.

Why it matters

PHP runs a large share of the web, and these are remote code execution holes across the whole 8.x line. The coordinated disclosure meant to give defenders a head start broke down: CVE IDs went public almost two days before the originally planned release, and a leaked proof-of-concept video then fed faster exploit development. The Wiz timeline also shows AI tooling (Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol) in the discovery of the first bug.

Who it affects

Anyone running anything on PHP, in Willison's words, across the entire PHP 8.x line. The Wiz timeline names Drupal and WordPress as targets where unauthenticated RCE was confirmed, so operators of those platforms have particular reason to check. The PHP project, the reporting firms and the coordinated-disclosure process itself also took the hit from the leak.

How to use it

Upgrade PHP today. Willison calls it vital, since exploits have been circulating since the night of October 20th. The excerpt does not name the patched version numbers, so check the PHP project's release announcement for the exact versions to install.

How solid is it

The post is a link-blog entry by Simon Willison that quotes the PHP Foundation's own account of the leak and relays a Wiz Research timeline. The incident details come from the PHP Foundation, so the sourcing is first-hand, though Willison's post quotes only an excerpt of it. The timeline of discovery and disclosure comes from the team that found the original vulnerability.

Risks and caveats

Exploits and PoCs are circulating, and the PHP Foundation says the video increased circulation on October 21st. The CVE IDs, the technical details of the bugs and the patched versions are not given in Willison's post, and neither is who leaked the CVE IDs or how. The source does not say whether the exploits have been used in attacks in the wild. The Wiz timeline says unauthenticated RCE was confirmed against Drupal and WordPress, but the post does not say whether this applies to both vulnerabilities or which versions were affected. The post's title also mentions strengthening PHP security, but the quoted excerpt covers only the incident.

“If you're running anything on PHP it's vital you upgrade”

— Simon Willison, simonwillison.net