Critical PHP Vulnerability Affects 60% of Websites and Network Appliances

A critical PHP vulnerability was patched on October 22nd, 2026, affecting approximately 60% of websites and numerous appliances including open-source routers and firewalls like OpenSense and pfSense, as well as commercial products from Cisco and PaloAlto. Two vulnerabilities were identified: an out-of-memory issue where PHP miscalculates memory during uploads leading to remote code execution, and a double-free vulnerability requiring two requests that can work together with the first vulnerability. The vulnerabilities are triggered before application code executes, making authentication and CAPTCHAs ineffective as protection, and they are exploited through multi-part MIME uploads. Updates are available for PHP version 8, but no patches exist for PHP 7 and PHP 5, which are still widely used. Exploitation began shortly after patch release, with a denial-of-service exploit released hours before the official patch. The vulnerability was discovered using AI tools by Whis, and one vendor released an update 5-7 hours early, giving attackers time to reverse-engineer exploits. The SANS Internet Storm Center raised their InfoCon level to yellow due to this incident.