ACT NOWExploited vulnerability
PHP Group PHP
PHP Stale Internal Request-State Vulnerability
What's happening and what to do
An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-26Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-29Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.