{"id":13790,"date":"2026-10-24T06:23:20","date_gmt":"2026-10-24T13:23:20","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=13790"},"modified":"2026-10-24T06:23:20","modified_gmt":"2026-10-24T13:23:20","slug":"critical-php-vulnerabilities-oct-2026","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/company\/critical-php-vulnerabilities-oct-2026\/","title":{"rendered":"Are You Affected by the October 2026 PHP Vulnerabilities?"},"content":{"rendered":"<div align=\"center\"><img loading=\"lazy\" decoding=\"async\" class=\"no-lazy-load\" src=\"\/blog\/images\/php-critical-vulnerabilities.webp\" style=\"padding-bottom: 20px;\" title=\"Are You Affected by the October 2026 PHP Vulnerabilities?\" alt=\"Are You Affected by the October 2026 PHP Vulnerabilities?\" border=\"0\" width=\"520\" height=\"293\"><\/div>\n<div id=\"blog-toc-container\" style=\"margin-top:20px;margin-bottom:40px;\">\n<p id=\"blog-toc-title\">In this article&#8230;<\/p>\n<ul>\n<li><a href=\"#affected\">Is your software impacted by PHP2Shell?<\/a><\/li>\n<li><a href=\"#alwaysup-web-service\">What about AlwaysUp Web Service? Does it use PHP?<\/a><\/li>\n<li><a href=\"#website\">Does your website use PHP? If yes, has it been patched?<\/a><\/li>\n<li><a href=\"#infosec-response\">How does your company respond to critical security issues like this?<\/a><\/li>\n<\/ul>\n<\/div>\n<p>On October 21, 2026, the <a href=\"https:\/\/thephp.foundation\/blog\/2026\/10\/21\/todays-php-security-release-and-how-were-strengthening-php-security\/\" target=\"_blank\">PHP project released new versions of PHP<\/a> to address a couple of critical vulnerabilities discovered in the software. They strongly encouraged everyone using PHP &mdash; <a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" target=\"_blank\">about 70% of the sites on the internet<\/a> &mdash; to update immediately, or face the prospect of attackers seizing control of unprotected servers.<\/p>\n<p>Since the announcement, we&#8217;ve had a few security-conscious customers reach out to see if our software is affected. The short answer is no, we&#8217;re not vulnerable, but let&#8217;s dig into the details below.<\/p>\n<p><a id=\"affected\"><\/a><\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\"><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">Is your software impacted by PHP2Shell?<\/h2>\n<p>No. The pair of vulnerabilities, called <a href=\"https:\/\/calif.io\/php2shell\/\" target=\"_blank\">PHP2Shell<\/a>, only affect PHP. And since none of our products embed or borrow components from PHP, they&#8217;re all in the clear.<\/p>\n<p><a id=\"alwaysup-web-service\"><\/a><\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\"><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">What about AlwaysUp Web Service? Does it use PHP?<\/h2>\n<p>Even though <a href=\"\/products\/AlwaysUp\/AlwaysUpWebService\/\">AlwaysUp Web Service<\/a> serves web pages and is accessible from your browser, it&#8217;s not impacted by the bugs. That&#8217;s because it uses its own, internally developed networking code &mdash; not PHP.<\/p>\n<p><a id=\"website\"><\/a><\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\"><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">Does your website use PHP? If yes, has it been patched?<\/h2>\n<p>Like the majority of the world&#8217;s websites, ours rely on PHP too. Our servers were vulnerable to PHP2Shell.<\/p>\n<p>So we moved quickly to fix them. The team paused and patched all our machines on the evening of October 21, and only approved versions of PHP are running today:<\/p>\n<div align=\"center\"><a href=\"\/blog\/images\/web-server-php-patched.png\" class=\"zoomPopup\" title=\"PHP is patched\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"image-padding\" src=\"\/blog\/images\/web-server-php-patched.png\" title=\"PHP is patched (click to enlarge)\" alt=\"PHP is patched\" border=\"0\" width=\"520\"><\/a><\/div>\n<p><a id=\"infosec-response\"><\/a><\/p>\n<hr class=\"blog-section\">\n<div style=\"width:100%;margin-bottom:30px;\">\n<div style=\"margin:0px;float:right;\"><a href=\"#top\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.coretechnologies.com\/images\/top.jpg\" border=\"0\" width=\"50\" height=\"18\" title=\"Go to the top\" alt=\"\"><\/a><\/div>\n<\/div>\n<h2 class=\"blog-caption\">How does your company respond to critical security issues like this?<\/h2>\n<p>As part of our information security program, we make it a point to apply operating system patches on a regular basis.<\/p>\n<p>In general:<\/p>\n<ol style=\"margin-bottom:24px\">\n<li>Patches to fix critical vulnerabilities are applied as soon as possible &mdash; automatically if possible and usually within 30 days.\n<p>And for truly exceptional threats like PHP2Shell, our goal is to take action within 24 hours of a fix becoming available.<\/li>\n<li>On Linux, high, medium and low vulnerabilities are addressed as part of quarterly updates.<\/li>\n<li>We update Windows machines at least monthly (after <a href=\"https:\/\/en.wikipedia.org\/wiki\/Patch_Tuesday\" target=\"_blank\">Patch Tuesday<\/a>).<\/li>\n<\/ol>\n<p>Stay safe!<\/p>\n<div style=\"margin-top:30px\" align=\"center\">\n<div class=\"cta-button-1\">\n<table role=\"presentation\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\" align=\"left\">\n<tbody>\n<tr>\n<td align=\"center\"><a href=\"\/blog\/category\/company\/\" title=\"More about our company\"><span class=\"nobr\">More Company Information&#8230;<\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<!-- relpost-thumb-wrapper --><div class=\"relpost-thumb-wrapper\"><!-- filter-class --><div class=\"relpost-thumb-container\"><h3>You may also like...<\/h3><div style=\"clear: both\"><\/div><div style=\"clear: both\"><\/div><!-- relpost-block-container --><div class=\"relpost-block-container relpost-block-column-layout\" style=\"--relposth-columns: 3;--relposth-columns_t: 3; --relposth-columns_m: 2\"><a href=\"https:\/\/www.coretechnologies.com\/blog\/alwaysup-web-service\/unable-to-connect\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Q&amp;A: How do I Connect to AlwaysUp Web Service to see my Windows Services?\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/network-services-150x150.png\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 100px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h3 class=\"relpost_card_title\">Q&amp;A: How do I Connect to AlwaysUp Web Service to see my Windows Services?<\/h3><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/service-security-editor\/windows-service-permissions\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Inside Windows Services: The Complex World Of Permissions\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/complex-world-windows-service-permissions-150x150-1.jpg\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 100px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h3 class=\"relpost_card_title\">Inside Windows Services: The Complex World Of Permissions<\/h3><\/div><\/div><\/a><a href=\"https:\/\/www.coretechnologies.com\/blog\/windows-services\/non-admins-control-services-remotely\/\"class=\"relpost-block-single\" ><div class=\"relpost-custom-block-single\"><img decoding=\"async\" loading=\"lazy\" class=\"relpost-block-single-image\" alt=\"Q&amp;A: Why Can&#039;t Non-Admins Start\/Stop Windows Services Remotely?\"  src=\"https:\/\/www.coretechnologies.com\/blog\/wp-content\/uploads\/remote-access-check-exemption-list-150x150-1.webp\" style=\"aspect-ratio:1\/1\" style=\"aspect-ratio:1\/1\"><\/img><div class=\"relpost-block-single-text\"  style=\"height: 100px;font-family: Arial;  font-size: 12px;  color: #333333;\"><h3 class=\"relpost_card_title\">Q&amp;A: Why Can&#039;t Non-Admins Start\/Stop Windows Services Remotely?<\/h3><\/div><\/div><\/a><\/div><!-- close relpost-block-container --><div style=\"clear: both\"><\/div><\/div><!-- close filter class --><\/div><!-- close relpost-thumb-wrapper -->","protected":false},"excerpt":{"rendered":"<p>In this article&#8230; Is your software impacted by PHP2Shell? What about AlwaysUp Web Service? Does it use PHP? Does your website use PHP? If yes, has it been patched? How does your company respond to critical security issues like this? &hellip; <a href=\"https:\/\/www.coretechnologies.com\/blog\/company\/critical-php-vulnerabilities-oct-2026\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":13793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[312],"tags":[201,397,418,419,143,220,270],"class_list":["post-13790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-company","tag-alwaysup-web-service","tag-information-security","tag-php","tag-php2shell","tag-security","tag-security-vulnerability","tag-software-vulnerability"],"_links":{"self":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/13790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/comments?post=13790"}],"version-history":[{"count":14,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/13790\/revisions"}],"predecessor-version":[{"id":13805,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/posts\/13790\/revisions\/13805"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media\/13793"}],"wp:attachment":[{"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/media?parent=13790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/categories?post=13790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.coretechnologies.com\/blog\/wp-json\/wp\/v2\/tags?post=13790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}