AI analysis
Claude Opus · 5 Nov 2026, 10:20 CET
PHP stale request-state flaw allows remote code execution and is actively exploited
A use-after-free flaw in PHP's handling of internal request state can let a remote, unauthenticated attacker run code on affected servers. CISA confirms active exploitation. Upgrade PHP beyond the affected ranges and check embedded PHP in Palo Alto Networks and Siemens products.
In plain terms
PHP is the programming language behind a very large share of websites and web applications. While handling a web request, PHP keeps some shared internal bookkeeping that points into memory used only for that request. In some situations this bookkeeping is not properly cleaned up when the request ends. The next request can then rely on information that points to memory that has already been released, which is known as a use-after-free (using memory after it has been handed back). The official description states that attackers can turn this into remote code execution, meaning they can make the server run commands of their choosing.
Anyone running PHP from version 5.4.0 up to the patched releases in each supported branch should care, as should operators of products that embed PHP. The record lists Palo Alto Networks PAN-OS and Panorama virtual appliances and several Siemens products, including RUGGEDCOM, Spectrum Power and Energy Engage systems. CISA has confirmed that the flaw is being exploited.