ON 22 October 2026, SANS ISC’s Stormcast focused on a critical PHP vulnerability that has widespread impact because PHP is used by roughly 60% of websites and many network appliances run PHP as well. The discussion notes that the flaw is in the PHP interpreter itself, so it does not depend on any specific application code or configuration.
Two related vulnerabilities were described: an out-of-memory issue triggered during multipart MIME uploads, which leads to un-cleared memory and can enable remote code execution; and a second, more complex, double-free scenario that relies on an initial request not fully clearing the context, followed by a second request to exploit the residual state. In practice, the two flaws can work together, with the first providing the conditions for the second. Exploitation was already underway, including a denial-of-service (DoS) exploit released just before the patch.
Regarding affected software and response, the podcast notes that PHP 8.x is expected to be mitigated by updates, while PHP 7 and PHP 5 remain without fixes. Many vendors—Cisco, Palo Alto, OPNsense, pfSense and others—have published advisories or updates; some open-source routers and appliances may be vulnerable.
Practical mitigations discussed include applying patches promptly, using web application firewall rules (though these can block legitimate uploads), or temporarily taking sites offline while upgrading and testing. Extra suggestions include adjusting PHP INI settings and, where possible, restricting multipart uploads or internal access to systems running PHP.
The episode also mentions Fortinet’s vague AI-assisted advisory and notes that the best long-term protection remains applying patched PHP versions and ensuring third-party libraries are compatible with PHP 8. The takeaway: patch quickly, assume compromise, and consider temporary shutdown if mitigation is not yet feasible.