Detecting a PHP Attack

The October 2026 PHP vulnerability that was released to the world requires website owners and operators to be aware of what risks that their operations are exposed.

The mitigation suggestions that the UK's NCSC (The National Cyber Security Centre) are not easy to understand (well they wern't to me when I read them, and I think that I know what this is all about). While it is true that a vast majority of the platforms on the Internet are built on technologies that use PHP at the time of me writing this thare have been no reported exploitations that have been the consequence of the two new flaws that were revealed on October 2026.

What was not made clear was that PHP Attacks have been omnipresent for a long time. I monitor the server logs for this website on a daily basis and I have not seen a marked increase in probes looking for PHP files that can be compromised.

How to detect if you have been attacked and are you at risk?

These two aspects need to be understood. Just because you have been attacked does not necessarily at risk. Your website will be probed on a regular basis by those looking for vulnerabilities.

The best way to determine whether you are being attacked and/or compromised it to monitor the traffic on your webserver. This needs to be peformed at the server level and most hosting providers have a means to allow you to monitor your server logs.

What you need to do

There is an emphasis on applying the latest patch to the PHP program used by your website. In most cases this will be something as a website owner/operator you will have to rely on your provider/host to fix. The patches to the PDP versions are better handled by someone who is an expert

Common Vulnerabilities and Exposures

There are two new exposures identified in the Oct 2026 disclosure:

• CVE-2026-109618 - RCE via OOM corruption - Remote Code Execution by Out of Memory status
• CVE-2026-109619 - RCE via stale global state - Remote Code Execution by "not tidying up"

The details for these vulnerabilities can be found on the github website.

As a website owner/operator don't even try to understand the descriptions on the github website.

What PHP version is your website using?

The patches that are available from PDP.net are for the latest versions of PHP. Versions 8.1 8.2 8.3 8.4 and 8.5

The exact versions of PHP that are affected and those that have been patched can be found on the links below.

Using Cloudflare as a mitigation method

The use of a CDN or Content Delivery Network is something that a "seious" website is likely to be using in any case. It waa suggested by NCSC that this would mitigate the risk of exploit regardless of what verion of PHP you website is using.

This is because all traffic is relayed through their nameservers and malicious code will be trapped there.

Remote Proceedure Call

I feature this on this page as it was mentioned as being something

Wordpress

As I saying many owner/operators will not know that they are potentially at risk. Those that run Wordpress sites will continue to the targeted by hackers as they always have. Whether these new vulnerabiliies are putting them at a greater risk has yet to determined

I think that is safe to say that this is not the last we will hear of this and I would not be surprisd if there are many Wordpress sites that are built on PDP releases that are older than the ones that patches have been worked out for.

In the case of this website my hosts Plesk Control panel tells me that the version of PHP is out of date. As I don't use PHP for this website it does not bother me. I am not sure if I have the option of updating it, or to request that it is updated.

I have designed and implemted a few forms that used PHP in their form handlers. As I have put this on the back-burner for now it is of no consequence. If I picked this up in the future I may have to reconsider learning a bit more about Python.

Using AI to determine threats