The PHP foundation announced there will be a security release tomorrow (Oct 21) addressing two critical PHP vulnerabilities that could lead to remote code execution. We'll all be racing against an exploit storm. Keep a close eye on your PHP-based frameworks.
To find your PHP instances using runZero, check out: https://www.runzero.com/blog/php/
And for the latest developments, tune into runZero Hour with our research team tomorrow at 1pm ET (link in 🧵).
runZeroCritical RCE vulnerability in PHP: Find impacted assetsPHP has announced a security release scheduled for October 21, 2026 that addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
