Ongoing since 09:44 AM UTC.
PHP RCE Advisory (CVE-2026-115560) Following the PHP Group’s latest security advisory (https://www.php.net/archive/2026.php#2026-10-23-1), the configuration-dependent remote code execution (RCE) issue highlighted in our previous update has now been assigned CVE-2026-115560. As reflected in our previous update, our Security team had proactively anticipated this vulnerability and implemented mitigations before the vulnerability was formally disclosed. The mitigations already in place align with the recommendations in the PHP Group’s latest advisory. Customers continue to be protected against the new CVE-2026-115560. No action is required from customers at this time. We continue to monitor developments and will adapt our protections as needed.
Update timeline
- monitoring Oct 23, 2026, 09:44 AM UTC
We are aware of the reports highlighting regressions in a few of the recent official PHP security patches. The official PHP Group has not yet published an official position or updated patches addressing these reports. Mitigations remain in place to protect customers against the currently known attack paths, and we continue to monitor for further developments. No action is required from customers at this time. The currently known regressions are: 1. Configuration-dependent RCE: A reported RCE demonstration affects PHP 8.5.12 (which may possibly affect earlier versions as well) under specific configurations. We have implemented mitigations that break the demonstrated exploit chain. Our customers remain protected against this specific attack path. 2. Memory-safety Regression: A separate, verified bug report identifies a potential double-free issue affecting PHP 8.4.27 and 8.5.12, which may cause crashes under specific conditions. This is currently a stability and memory-safety concern, not a critical security issue (e.g., remote code execution). We are monitoring the situation and will continue to respond quickly to new vulnerability details or attack techniques as they emerge. If you have any questions, please reach out to our support team.
- monitoring Oct 23, 2026, 02:06 PM UTC
PHP RCE Advisory (CVE-2026-115560) Following the PHP Group’s latest security advisory (https://www.php.net/archive/2026.php#2026-10-23-1), the configuration-dependent remote code execution (RCE) issue highlighted in our previous update has now been assigned CVE-2026-115560. As reflected in our previous update, our Security team had proactively anticipated this vulnerability and implemented mitigations before the vulnerability was formally disclosed. The mitigations already in place align with the recommendations in the PHP Group’s latest advisory. Customers continue to be protected against the new CVE-2026-115560. No action is required from customers at this time. We continue to monitor developments and will adapt our protections as needed.
Your product runs on more than Cloudways
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services