Tenable Security Center

The fixed releases shipped on 2026-10-21 between 13:30 and 14:00 UTC, depending on the source, together with the technical advisories, so the earlier statement that no fix existed no longer holds (CERT-EU, 2026-10-21; ENISA, 2026-10-21; Sansec, 2026-10-21). ENISA, the European Commission, CERT-EU, Europol EC3 and the CSIRTs network advise organisations to identify their PHP-based applications, coordinate with hosting and service providers, apply the update to internet-facing systems first, and isolate exposed applications from public networks where that is not possible (ENISA, 2026-10-21). BACS published its warning the same day, telling operators to check embedded and internal PHP installations as well as public sites, to restart long-running PHP processes and rebuild containers, to verify the running version, and, where an immediate update is impossible, to consider disconnecting critical applications from the internet (BACS, 2026-10-21). BACS told RTS it knows of no reliable, confirmed substitute for the updates and that the interim measures give no guaranteed full protection (RTS, 2026-10-21).

Attack traffic was reported on the day: Cloudflare saw it against its customers while the flaws were still leaked, watchTowr's honeypots recorded exploitation, and VulnCheck's canary hosts logged scanning from 08:37 UTC and at least one unsuccessful web-shell attempt through a session file, while VulnCheck says it holds a working exploit for CVE-2026-109618 that succeeds on x86-64 with ASLR enabled; no source reports a confirmed compromise (Cloudflare, 2026-10-21; watchTowr, 2026-10-21; VulnCheck, 2026-10-21). Palo Alto Networks confirmed that every PAN-OS and Panorama release is affected through the management web interface, with no fixed release yet (Palo Alto Networks, 2026-10-21).

Public-sector sites went offline as a precaution, mostly on the evening of 2026-10-21. The canton of Basel-Stadt activated its crisis staff and shut down every PHP-run cantonal website with no restoration time given, while stating that no security-relevant incident had been registered (Canton of Basel-Stadt, 2026-10-21). The Ticino cantonal administration temporarily disabled some online services, the website of the University of Geneva was unreachable, and the EPFL site displayed a notice that its pages were currently unreachable, although nau.ch says it still worked (nau.ch, 2026-10-21); RTS lists the EPFL and University of Geneva sites as temporarily suspended (RTS, 2026-10-21). Several Neuchâtel canton and city sites were unreachable without an official statement; Arcinfo presumes a link to the PHP flaw, which the state had not confirmed (RTS, 2026-10-21). Lodur, the platform many Swiss fire brigades use to manage their fire brigades and alarm groups, was out of service because its provider took its servers offline as a precaution: users could neither read stored data nor edit alarm groups, though the Valais cantonal fire office said this does not necessarily mean the alarm-triggering systems are down (nau.ch, 2026-10-21; RTS, 2026-10-21). Publica took its website offline on the afternoon of 2026-10-21 as a precaution, says it has closed the vulnerabilities with security updates and was back online that evening, and states the outage is unrelated to the cyberattack on its software supplier (Publica, 2026-10-21). Dutch authorities took DigiD, MijnOverheid, Overheid.nl, TweedeKamer.nl and the tax authority offline for a time, and most were back by that evening (Security.nl, 2026-10-21); RTS reports that the site of the Paris police prefecture was also suspended (RTS, 2026-10-21). Basel-Stadt said it would report on progress on the morning of 2026-10-22, and no restoration status had been published as of the early morning of 2026-10-22 UTC.

BACS told Keystone-SDA and SRF on 2026-10-22 that no attack in Switzerland attributable to the two flaws is known to it, while stressing that unrecognised or unreported incidents cannot be excluded and that it has no reliable figures on affected websites, shops and internal applications (SRF, 2026-10-22; watson.ch, 2026-10-22). It also said that PHP-based applications of the federal administration were affected, that the responsible bodies were told to update, and that it has no complete overview of the update status (watson.ch, 2026-10-22; Inside IT, 2026-10-22).

The shutdowns were large and mostly short. The Basel host Cyon took all of its more than 100,000 customer websites offline for some hours and says everything has run again since the morning of 2026-10-22; the University of Geneva's site was still unreachable that afternoon, and Basel-Stadt still had pages offline at midday and says it found no data outflow (SRF, 2026-10-22). Neuchâtel disabled all PHP-based sites, ne.ch and many commune pages among them, its IT department installed the fix, and the EPFL gave its members access to its services by VPN while its site stayed down (Inside IT, 2026-10-22). Risikomonitor's live view counts 576,549 checked Swiss web servers, 540,169 already patched and 20,231 (3.5 %) still affected, with the PHP version hidden on the other 16,149 (Inside IT, 2026-10-22).

In the United Kingdom, a minister told the House of Lords on 2026-10-22 that 32 government services were unavailable and four partly unavailable, largely from precautionary measures while updates and mitigations were applied, and that the government knows of no confirmed compromise of central government systems, an assessment she extended to the wider public sector (UKAuthority, 2026-10-22; The Register, 2026-10-22). The Register adds that government sites in Germany, France, Belgium, Finland and the Netherlands were also taken offline as a precaution and that the NCSC sent 50,000 warnings (The Register, 2026-10-22).

Attack activity began before the release. Inside IT, citing a post by Cloudflare's chief executive, reports millions of attack attempts, the first at 07:43 UTC on 2026-10-21, more than six hours before the release, and relays that AWS threat intelligence recorded an exploit attempt against a honeypot on 2026-10-17 from a commercial anonymisation network, proofs of concept and attempts by several actors from 2026-10-21, and advises an operator who cannot exclude a compromise to start the investigation at least from 2026-10-17; whether the attempts would have succeeded on real systems is open (Inside IT, 2026-10-22). The Register likewise reports that AWS says attackers were exploiting the flaws four days before disclosure (The Register, 2026-10-22).

Palo Alto Networks' Unit 42 updated its brief on 2026-10-23 to report a confirmed intrusion: attackers using agentic AI attack platforms for post-exploitation against a government entity in Europe reached password hashes and multi-factor authentication secrets within two hours of the initial exploitation, set up an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation (Unit 42, 2026-10-23). Unit 42 reads the markers as those of an agentic attacker: each command batch is wrapped in section-header delimiters such as ==SHELLUSER== and ==PASSWD==, the tasks are short and serially spaced, and the attacker pivots quickly after failures (Unit 42, 2026-10-23). The account rests on Unit 42's own telemetry; it names no victim and does not say which flaw gave the foothold (Unit 42, 2026-10-23).

It sits against reports of no successful exploitation. CrowdStrike has not observed any in the wild or in its honeypots and expects a reliable exploit only against a specific deployment profile, such as a fixed Docker image (CrowdStrike, 2026-10-23); Wordfence knows of no compromise among the more than 74,000 attempts its firewall intercepted (Wordfence, 2026-10-22); and Sophos corrected on 2026-10-22 its earlier report of successful exploitation to scanning and a small number of failed attempts, one of them a blocked attempt to deliver a likely Mirai-derived botnet variant (Sophos, 2026-10-22). VulnCheck's exploit now covers PHP 8.4.10 to 8.4.26 and 8.5.10 and 8.5.11 on AMD64 and ARM64 with default settings and display_errors off under mod_php, and WordPress on default Docker installs, as of 5:30 PM ET on 2026-10-23 (VulnCheck, 2026-10-21). Neither flaw is in CISA's KEV catalog as of version 2026.10.23 (CISA KEV, 2026-10-23).

PHP posted an informational advisory on 2026-10-23 for a third code-execution path, CVE-2026-115560, that the October releases do not fix: it needs an application that sets session.serialize_handler to php_binary or php_serialize, switches it to php with ini_set() before session_start(), and leaves session upload progress enabled (PHP, 2026-10-23). PHP calls it an unlikely vector, issues no emergency release, suggests session.upload_progress.enabled=0 until the next regular bugfix release, says a host that applied that setting from the 2026-10-21 advisory should keep it, and will publish the full advisory with the next release (PHP, 2026-10-23). PHP has not stated affected versions or a severity score, and no exploitation is reported (The Hacker News, 2026-10-23).

Vendor statuses moved. Cisco's advisory, revised on 2026-10-23, now describes a workaround for Expressway in its bug record, keeps the fixed release 15.5.21 undated, lists Ultra-Reliable Wireless Backhaul with a fix in 27.1.1 (February 2027), exploitable there only by an authenticated administrator and with a workaround described, and lists Duo Access Gateway with fixed release 3.2.0 (Cisco PSIRT, 2026-10-23). Splunk now lists only Smartlook as under investigation (Splunk, 2026-10-23). Palo Alto Networks' advisory now lists WF-500 and WF-500-B as unaffected, a correction its timeline dates 2026-10-23, its table no longer distinguishes Panorama, and a note says the issue applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama; the PAN-OS hotfix dates of 2026-10-26 to 2026-10-30 are unchanged (Palo Alto Networks, 2026-10-24).

Tenable's Security Center (versions 6.6.0, 6.7.2, 6.8.0 and 6.9.1) and Enclave Security (1.7.0, 1.8.0 and 1.9.1) bundle PHP, and patch SC-202610.2 updates the bundled PHP to 8.2.35 (Tenable, 2026-10-23; Tenable, 2026-10-23). Siemens lists RUGGEDCOM APE1808 application-hosting devices running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 as affected by the two flaws and gives patch and update information only through customer support (Siemens ProductCERT, 2026-10-23).

ReliaQuest says it independently reproduced exploitation of CVE-2026-109618 in controlled labs, with code execution only where the exploit's prerequisites were already present, and that it has not observed successful exploitation in customer environments (ReliaQuest, 2026-10-22). The sequence it saw in its logs is a POST that returns HTTP 500, PHP memory exhaustion reported "in Unknown on line 0", heap corruption and an abort of the Apache worker that handled the request within seconds, which it reads as a stronger indication when the events involve the same process (ReliaQuest, 2026-10-22).