The National Security Agency's fallback for two critical PHP flaws is to take systems offline. That advice is hard to follow where PHP ships inside a vendor's product and the fix date belongs to the vendor.

By Shashi Bellamkonda · October 23, 2026

Because the National Security Agency set its fallback for the two PHP flaws as taking a system offline until it can be fully mitigated, every operator needs to know which of its systems run PHP. PHP serves nearly 70 percent of websites whose server-side language is known (W3Techs, 2026), and the agency said more specific guidance would follow its October 21 advisory. I covered the patches and the edge rules in an earlier post.

Some of the PHP you run came inside products you bought from vendors

Both flaws live in the PHP runtime, so updating a plugin or application code fixes nothing. A WordPress site and a vendor appliance both need the engine underneath replaced, and the owner of the appliance cannot do that without the vendor.

Plugins that a marketing team installed years ago and appliances that list a web interface but not the language beneath it are the usual blind spots. An inventory built from public DNS records will miss the management console behind the VPN, and that console is often where the exposure sits.

PHP's maintainers saw early signs of the flaw in 2024 and shipped the fix in October 2026

The PHP Foundation traces the out-of-memory flaw to 2024. The first external security audit in years, run by Quarkslab with funding the Foundation secured from Germany's Sovereign Tech Agency, led a core developer to the first signs of it. The team theorized a potential exploit at the time but found no concrete attack path, and other issues with clearer impact took priority.

The security team then drafted competing fixes, and each carried a cost, from broken backward compatibility to changes in many third-party extensions. Work stalled and restarted for months. The Foundation calls the delay a structural failure of its own decision process and resources, and says the team is moving to majority decisions so compromises get made faster.

Calif reported unconditional remote code execution with the same root cause on August 11, after starting an audit on July 30. Wiz followed on August 24, and OpenAI sent further attack vectors on September 18. From August 11, the Foundation made the fix its top security priority.

That is about ten weeks from the report that showed the full impact to a shipped fix.

AI-assisted research has raised the number of reports the security team receives. It has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates, or not reproducible (PHP Foundation, 2026). You inherit that team's decision speed for every PHP dependency in your stack, which turns the Foundation's request for sponsorship from companies, hosting providers, and governments into a supply-chain issue for your risk register.

The first known attack attempt came four days before the patch

On October 20, at about 15:00 UTC, the two CVE identifiers began circulating with a wrong release time and a wrong CVSS score of 10.0. The project published its advance notice at 19:30 UTC and moved the release up a day, to October 21 at 14:00 UTC, because distributors were still packaging the fix. The Foundation also reports that Calif mistakenly published a video of its proof of concept that evening, and that Chainguard released built images containing the fix at 07:41 UTC on October 21, more than six hours before the coordinated release.

Amazon saw its first attempt on October 17, from an anonymized address, four days before disclosure (Amazon, 2026). Between 02:00 and 08:00 UTC on October 21, its honeypots recorded more attempts with varied payloads, which Amazon reads as multiple actors, and it says it is unclear whether any would have worked against real systems. Cloudflare saw attack traffic against its customers and attackers changing payloads to get around its rules, which went live at 03:02 UTC, about nine hours before disclosure (Cloudflare, 2026).

Neither company has published a count of confirmed compromises, and both Palo Alto Networks and Cisco say they know of no malicious use against their own products. Amazon advises incident responders to start investigations from October 17, since an investigation that begins on October 21 misses the first documented attempt.

An inventory built from public DNS records misses the management console behind the VPN, which is often where the exposure sits.

Vendor fix dates run from this week to February 2027

Where PHP is embedded in a product, the date belongs to the vendor, and the two vendors below have published theirs. Government websites across Europe chose the offline route on October 21 (CTV News, 2026), a decision a web team can make in minutes, though it is harder to make for a security management plane.

• Palo Alto Networks. Its firewall software (PAN-OS) and the Panorama tool that manages many firewalls are affected through their web-based administration pages. The company expects fixes between October 26 and October 30, depending on the software version, and has no fix date yet for its WildFire WF-500 and WF-500-B appliances (Palo Alto Networks, 2026). Risk is highest when those administration pages can be reached from the internet, so the company recommends allowing access only from one secured computer until the fix arrives.
• Cisco. Its advisory, updated October 23, lists three affected products. Duo Access Gateway has a fix available now. The Expressway voice and communications products have a fixed version (15.5.21) with no release date yet. The Ultra-Reliable Wireless Backhaul gets its fix in February 2027, and an attacker would need administrator credentials to exploit it there, which Cisco rates at 6.6 on a 10-point scale. Cisco says 13 more products are still under investigation and that any product not listed is unaffected (Cisco, 2026).

For systems that cannot be patched yet, Amazon says no configuration-only change covers both flaws, and suggests considering a block on multipart file uploads after you test the effect on the application. Cloudflare adds that limiting upload sizes reduces exposure while the fix is pending. Those are stopgaps, and they sit alongside the NSA's offline guidance as the options open to the owner of an appliance with a pending date.