https://reddit.com/r/sysadmin/comments/1xdpp0h/how_the_planet_gets_hacked_in_seconds_and_why/: How the Planet Gets Hacked in Seconds (and Why Updating Isn't Optional)

Q: Which PHP releases contain the fixes?

The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Earlier releases in the PHP 8.x branches are described as affected.

Q: Are end-of-life PHP branches covered by an official fix?

No official release is available for PHP 8.1 or older. Systems on those branches would need to move to a supported fixed release.

Q: Does exploitation require an authenticated application user or account?

No. The flaws are described as unauthenticated remote code execution vulnerabilities, so an attacker does not need to authenticate before attempting exploitation.

Q: How urgent is remediation once a vulnerable internet-facing PHP server is identified?

Exploitation attempts were reported within hours of the fixes being released, with millions of attempts reported. Internet-exposed systems should be prioritized because automated probing can begin rapidly after patch details become available.

Published Oct 23, 2026

Updated

Affected Software

2 affected components

PHP PHP<8.2.35, <8.3.36, <8.4.27, <8.5.12

Node.js Node.js<22.23.4, <24.22.1, <26.12.1

Frequently Asked Questions

Which PHP releases contain the fixes?

The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Earlier releases in the PHP 8.x branches are described as affected.

Are end-of-life PHP branches covered by an official fix?

No official release is available for PHP 8.1 or older. Systems on those branches would need to move to a supported fixed release.

Does exploitation require an authenticated application user or account?

No. The flaws are described as unauthenticated remote code execution vulnerabilities, so an attacker does not need to authenticate before attempting exploitation.

How urgent is remediation once a vulnerable internet-facing PHP server is identified?

Exploitation attempts were reported within hours of the fixes being released, with millions of attempts reported. Internet-exposed systems should be prioritized because automated probing can begin rapidly after patch details become available.