---
title: "The Fix Was Free. Finding Every Copy Was Not."
description: "Government websites across Europe went dark on October 21, their operators pulling systems offline within hours of a PHP security release that fixed two critical remote-code-execution bugs. The patch was public within hours of the disclosure, which means somebody competent"
url: https://kaynemcgladrey.com/blog/the-fix-was-free-finding-every-copy-was-not/
date: 2026-10-22
modified: 2026-10-22
author: "Kayne"
image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/new-php-logo.webp
categories: ["Blog"]
type: post
lang: en-US
---

# The Fix Was Free. Finding Every Copy Was Not.

Government websites across Europe went dark on October 21, their operators pulling systems offline within hours of a PHP security release that fixed two critical remote-code-execution bugs. The patch was public within hours of the disclosure, which means somebody competent did the hard work in advance and handed everyone else a tested fix.

Plenty of organizations running vulnerable PHP right now don’t know it. It’s baked into a content management system, a vendor appliance, a container image someone built in 2023 and nobody has audited since. Downloading the fix cost nothing, and finding every copy is where the real cost and the legal exposure live.

## What Landed on October 21

PHP shipped patched releases across four supported branches: [8.5.12, 8.4.27, 8.3.36, and 8.2.35](https://www.php.net/archive/2026.php#2026-10-21-5). Two flaws are addressed, tracked as [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) in the Common Vulnerabilities and Exposures registry. Neither requires credentials, and both let a stranger execute code on your server.

| PHP branch | Patched release |
| --- | --- |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |

### The mod_php Problem

The detail separating this from a routine patch cycle is that the demonstrated exploit fires before any application code runs. Web application firewall rules, input validation, and a hardened content management system do nothing to stop it. Anything serving requests through PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed is exposed, and mod_php, the Apache module that runs PHP inside the web server process, is the worst case because the working exploit was demonstrated there, executing with the web server’s own privileges.

## Everyone Got the Same Warning

Regulators rarely get a fact pattern this clean, and within a day of the release the warnings stacked up from every direction.

- The [PHP project’s own advisory](https://www.php.net/archive/2026.php#2026-10-21-5) urged immediate updates
- The Cybersecurity and Infrastructure Security Agency (CISA) published [an advisory](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac) telling organizations to patch
- [Reuters](https://www.reuters.com/business/php-programming-language-developers-issue-new-version-fixing-critical-2026-10-21/) carried the story to a general audience

> The National Security Agency’s [statement](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-php-updates/) was blunter than most, warning that flaws like these “often provide a direct path to the server’s file system or database.”

## What If You Haven’t Patched Yet?

### How Regulators Build Cases

An [Atlantic Council analysis of 47 cybersecurity enforcement actions](https://www.atlanticcouncil.org/in-depth-research-reports/report/reasonable-cybersecurity-in-forty-seven-cases-the-federal-trade-commissions-enforcement-actions-against-unfair-and-deceptive-cyber-practices/) brought by the Federal Trade Commission found the commission builds unreasonableness findings from three ingredients. All three are present here in amplified form.

| Ingredient | What the FTC looks for | What happened here |
| --- | --- | --- |
| Foreseeability | Public warnings, industry consensus, prior incidents involving the same flaw | Announced by name, with CVE numbers, on national news |
| Cost of mitigation | Fixes described as “readily available” and “free or low-cost” | A free download from a public repository |
| Prior enforcement | Earlier complaints cited as constructive notice | Wyndham and CafePress both involved unpatched or obsolete web server software |

> “Only an update is a complete solution.”

### The Private Litigation Track

Regulatory exposure is the slower clock, and contracts move faster. After the 2017 NotPetya outbreak, Nuance Communications faced a customer lawsuit seeking nearly $11 million. The client had patched its own systems and expected its vendor to do the same. Service providers sitting on unpatched PHP while clients cleaned up their side on October 21 should be re-thinking their delays.

## Regulators Already Expect You to Know What You Run

Saying that nobody knew PHP was embedded in a vendor product doesn’t hold up. Three regulatory fronts are ready to take that argument apart:

- New York’s financial services rules, fully effective in November 2025, mandate a documented asset inventory program tracking patch status and end-of-support dates for every application, backed by annual compliance certifications
- The Department of Justice has extracted eight-figure settlements from government contractors over misrepresentations about patch and vulnerability-management posture, with no breach required
- Contractual security representations built on National Institute of Standards and Technology standards turn unpatched critical infrastructure into a delivery dispute waiting to happen

Ignorance of your own software stack is now itself a finding. Any company that filed its annual certification with New York on April 15, 2026 should be asking what that inventory currently says about its PHP estate.

## The Two-Year Head Start Nobody Used

Signs of one flaw surfaced in 2024. According to Reuters, the PHP Foundation conceded the issue was theorized at the time but shelved because no concrete attack vector appeared and clearer problems demanded attention. The Foundation has since called the delay [a structural failure](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/). It took a frontier AI model provider some tokens to turn that 2024 flaw into the current mess.

This complicates the blame narrative for companies leaning on open source without funding it, auditing it, or tracking what’s inside it. You inherit the upstream project’s triage decisions along with its code. None of which excuses leaving a critical patch unapplied, and none of which helps you locate the copies you don’t know about.

## If You Haven’t Patched

Patch first. Versions are [on the PHP site](https://www.php.net/downloads.php), and it’s a routine package update for anyone on a supported branch. If you can’t get there today, the advisory lists configuration mitigations that blunt each bug while you schedule the real fix.

### For CVE-2026-109618

The memory-corruption flaw. Raise `memory_limit` to its maximum so allocations can’t be forced to fail mid-request. Cut `post_max_size` to the smallest value your application actually accepts, since larger uploads give an attacker more room. These settings apply before request parsing begins, so a config reload that lands late buys you nothing.

### For CVE-2026-109619

The stale-state flaw. Disable `session.upload_progress.enabled` outright. Set `pm.max_requests` low so workers recycle frequently and freed memory stops being useful to whoever’s probing it.

### The End-of-Life Trap

The genuinely ugly situation is anything older than PHP 8.1, which gets no official updates and whose popular third-party repositories weren’t carrying fixes on day one. In theory, backports exist for organizations building from source. On an unsupported branch, your options narrow to an upgrade project or indefinite exposure, and every day of deliberation is a day attackers spend with the exploit.

### Write It Down

Treat the mitigations as scaffolding with an expiration date, because the advisory is explicit that partial measures buy time and nothing else. An auditor or opposing counsel will read an indefinite mitigation-without-patch posture as deliberate risk acceptance on a critical, unauthenticated remote-code-execution flaw. Document what you couldn’t patch, why, what you put in its place, and when the real fix lands.

## This Is Where an SBOM Would Have Helped

A software bill of materials wouldn’t have patched anything on October 21. But it would have collapsed the discovery phase from days of grepping file systems and pestering vendors into minutes, and that difference decides whether you beat the exploit wave or absorb it.

PHP turns up in places nobody watches. There’s the WordPress install marketing stood up in 2019, plus the shipping plugin ops barely remembers and the appliance firmware no vendor has ever described in detail.

The [2026 Minimum Elements for a Software Bill of Materials](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) came out in July, published by CISA with the National Security Agency, the Federal Bureau of Investigation, and more than a dozen international partners. SBOMs are meant to help at times like this, and it asks for four things that would have answered the main questions companies needed.

- Specific component versions, so you know whether you’re on 8.2.34 or 8.2.35
- Machine-readable identifiers that correlate directly with vulnerability databases
- Full coverage including transitive dependencies, not just the code you wrote yourself
- Explicit labeling of unknown components

Most organizations buying software can’t generate this for the products they purchase. That’s the vendor-side lesson of October 21, and it belongs in your next procurement round. If your suppliers can’t tell you what’s in what they sold you, you now have another case study explaining why that matters.

## What Comes Next

Nobody knows the damage count yet. Security researchers quoted by Reuters expected attackers to reverse engineer the patch quickly, which is typically how these go.

The long tail is where this turns unpleasant. Maintained platforms will patch. Abandoned WordPress sites, products nobody has touched since the developer vanished, and appliances whose firmware updates ended three models ago become permanent attacker footholds over the coming months. The headline window on this event runs about two weeks. The exposure window runs for years.

The organizations that come through this cheapest were tracking their software before October 21. Everyone else finds out one forgotten server at a time.