PHP: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 5
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
CERT-EU’s 21 October advisory describes two unauthenticated remote-code-execution vulnerabilities and identifies patched PHP branches. It says all web-serving installations need assessment, with Apache mod_php considered the highest-risk configuration. Application-level login controls do not remove a runtime vulnerability.
Research reviewed 22 October 2026: CERT-EU PHP advisory. Primary advisory revisited.
Where the evidence stops
A vulnerable installation is not evidence that its customer records were accessed. Market share cannot establish an affected-user count.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Map public hostnames to the actual executing runtime, including containers, appliances, hosting control panels and background workers. Record the owner and patch authority for each deployment.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Record running worker versions and image digests, not just package manifests. Test the external traffic path and a representative transaction, and record who reviewed suspicious activity.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Reopen only when the runtime remediation is verified, critical trading tests pass, and the incident owner has decided whether further investigation is required.