Skip to main content
All rules

SEC-050

PHP version open to the October 2026 remote code execution flaws

CriticalDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

What it checks

Server and X-Powered-By headers that state an exact PHP version, compared with the releases that fix CVE-2026-109618 and CVE-2026-109619 (8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.6.0 RC4). Distribution builds (such as 8.2.10-2ubuntu2.3) and servers on systems that backport fixes (Red Hat, CentOS, AlmaLinux, Rocky, Amazon, Oracle, SUSE, Debian, Ubuntu) are skipped, because their version number does not show whether the fix is in. Sites that hide the PHP version are not judged.

Why it matters

Both flaws let anyone on the internet run their own code on the server without signing in, and public exploit tooling exists. That means full control of the site, its files and the database credentials it holds.

Recommended fix

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer (PHP 8.1 and older: move to a supported branch), restart PHP-FPM or the web server, then set expose_php = Off.

How to verify

Check the version in the hosting panel or with php -v on the server, then rescan.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-050: PHP version open to the October 2026 remote code execution flaws
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The server runs a PHP version without the fixes for CVE-2026-109618 and CVE-2026-109619 (unauthenticated remote code execution). Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer (hosting panel: the PHP version setting; own server: the package manager or the official Docker image tag), or move off PHP 8.1 and older to a supported branch. Restart PHP-FPM or the web server, set expose_php = Off in php.ini so the version is no longer advertised, and check that the site and its plugins still work.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Check the version in the hosting panel or with php -v on the server, then rescan.

References