AI analysis
Claude Opus · 5 Nov 2026, 10:19 CET
PHP out-of-memory handling flaw enables unauthenticated remote code execution
A critical memory corruption flaw in PHP 7.3 through 8.5 can lead to remote code execution without authentication. CISA confirms active exploitation. Upgrade PHP and apply Palo Alto Networks and Siemens guidance for embedded products immediately.
In plain terms
PHP is a widely used programming language that runs many websites and web applications. It is also built into some commercial products, such as network security appliances and industrial software. This flaw is in how PHP recovers when it runs out of memory while handling a web request. In some situations PHP leaves part of its memory in an unpredictable state. When it later cleans up after the request, it can act on that leftover data.
According to the official description, attackers can reliably trigger this condition and turn it into remote code execution (RCE), meaning they can run their own commands on the server. No login is needed. Anyone who runs PHP-based websites or applications, or who operates the listed Palo Alto Networks or Siemens products, should treat this as an emergency.