Both vulnerabilities carry a CVSS v4.0 score of 9.2. Every prior release is susceptible, and reports indicate exploitation in active environments.
Operators must immediately patch to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 if PHP is utilized anywhere in their infrastructure.
These bugs reside in the PHP core, affecting any setup serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP identifies mod_php as presenting the highest risk.
Exploitation is being observed, with watchTowr reporting activity in its honeypot network as of October 21, and Tenable citing Cloudflare's CTO noting early attacks.
While VulnCheck confirmed code execution on ARM64 and x86 systems when ASLR is disabled, Red Hat assesses the Remote Code Execution as difficult in practice on default PHP-FPM deployments.
The complexity of remediation stems from the difficulty in inventorying all instances of PHP, as it can be found in various locations beyond standard package management.
This widespread presence across OS packages, macOS installations, bundled Windows copies, application-specific shipments, and container images necessitates examining binaries directly to confirm versions.
The broader industry trend reflects increasing urgency in vulnerability management, where the rapid public disclosure of patch differences accelerates the maturation of exploit techniques across platform components.
