Vulnerability advisoriesPHP / Palo Alto Networks Unit 42

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP has released fixes for two major vulnerabilities and warns that certain Session settings still need attention. Unit 42 subsequently withdrew its attribution of a government organisation's compromise to PHP2Shell. Read patch requirements separately from evidence about the cause of that incident.

Anti-Ransomware · Compiled with SI agent assistancePHP advisory: 2026-10-21; follow-up and research correction:Checked 2026.10.26
Illustration of a female bakery owner checking online orders and receipts
Illustration · Source ↗ · About this image ↗

Source Facts

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix CVE-2026-109618 and CVE-2026-109619. Organisations using distribution-maintained packages should also check whether their supplier has backported the fixes.

On 23 October, PHP added guidance on another issue that arises only under a rare combination of settings: an application first sets a particular Session serialisation method, then changes it during execution while upload progress remains enabled. The official advice is to disable that feature in relevant environments and await full fix details in a regular release.

On 25 October, Unit 42 said it could not confirm that the initial intrusion at a European government organisation was linked to the two CVEs above and withdrew its earlier assessment. This correction does not negate the vulnerabilities or the need to patch. Scanning or suspicious activity must not be equated with successful exploitation.

Next Steps for Businesses / Editorial Observations

Record patch status, configuration conditions and confirmed intrusion evidence separately to avoid judging risk from outdated headlines.

Next steps you can take

  • Check PHP patch status across websites, administration platforms and hosted services, then test critical functions after updating.
  • Have operations staff check whether the supplementary settings of 23 October apply, and retain logs for incident analysis.

Original sources

Reporting leads · The Hacker News · 6 articles consolidated

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Security advisory: Critical remote code execution vulnerabilities, update now / Informational advisory: Session upload progress

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETOriginal synthetic illustration of an archive system administrator checking a server maintenance checklistIllustrationThreat Advisories · 2026.10.24

Linux KSMBD file-sharing issue disclosed: first check whether the service is enabled

CSIRT.SK / Sysdig