Critical PHP Vulnerabilities Trigger High-Alert Security Advisory from MIIT

The Ministry of Industry and Information Technology's (MIIT) Network Vulnerability Database (NVDB) has recently identified two critical-severity remote code execution (RCE) vulnerabilities within the PHP ecosystem. This discovery raises immediate concerns for the security of web infrastructures globally.

Severity and Scope of Impact

As a cornerstone of modern web development, PHP's security is paramount. These vulnerabilities are particularly dangerous because they allow unauthenticated attackers to execute arbitrary code on vulnerable servers.

A successful exploitation could lead to:

  • Complete server compromise and control by attackers
  • Exfiltration of sensitive data and user information
  • Service disruption and business downtime
  • Pivoting for deeper network penetration

The affected PHP versions are extensive, including:

  • 8.5 series (versions prior to 8.5.12)
  • 8.4 series (versions prior to 8.4.27)
  • 8.3 series (versions prior to 8.3.36)
  • 8.2 series (versions prior to 8.2.35)
  • 8.1 series and all earlier releases

Official Patches and Interim Mitigations

The PHP security team has released patched versions. Details are available in the official security announcement dated October 21, 2026.

For organizations that cannot upgrade immediately, the MIIT recommends implementing temporary safeguards:

  • Consider temporarily taking affected services offline
  • Disable the session upload progress functionality in configuration
  • Enforce strict network segmentation and access controls for vulnerable systems

Recommended Proactive Security Measures

Beyond patching, a holistic security review is crucial. All PHP users should:

Conduct an urgent, comprehensive audit of all assets to identify services running vulnerable PHP versions. The highest priority is to upgrade these environments to the latest secured releases.

Post-upgrade, immediately rotate all associated credentials, API keys, and certificates to prevent attackers from leveraging old access tokens. Enhance network monitoring to detect anomalous execution patterns and suspicious traffic, enabling rapid response to any intrusion attempts.