Comprehensive guidance for website owners, freelancers, system administrators, and government IT teams responding to critical remote code execution vulnerabilities in the standard PHP hypertext preprocessor runtime.
This advisory concerns the open-source PHP runtime and is NOT evidence of a BotDigit platform breach. BotDigit’s core platform infrastructure, multi-currency ledger, smart-contract escrow engine, API gateways, and user databases run exclusively on high-performance, memory-safe Rust (Axum) and Next.js / TypeScript services. BotDigit does not execute PHP runtimes on any production infrastructure.
A server running a PHP binary below upstream thresholds or without vendor backports. Presence of a vulnerable version creates exposure risk, but does not prove active compromise.
An attacker has successfully delivered crafted multipart or FastCGI payloads triggering memory corruption or unexpected process invocation. Identified via server error and access log analysis.
An attacker has established unauthorized persistence, uploaded web shells, altered application code, or extracted database contents. Requires formal forensic incident response.
Technical analysis of the underlying memory management flaws and handler attack vectors.
Underlying Flaw: An off-by-one boundary calculation error within the core PHP stream multipart parser (rfc1867.c). When processing specially malformed chunked multipart HTTP POST streams, boundary termination pointers can be manipulated to trigger heap buffer corruption.
Prerequisites: Web application endpoint accepting HTTP file uploads (multipart/form-data) processed through standard PHP request stream handlers.
Remediation: Upstream bounds check hardening in stream buffer parser and integer overflow checks on chunk allocations.
Underlying Flaw: FastCGI / PHP-FPM environment variable injection vulnerability resulting from parameter desynchronization between reverse proxies (such as Nginx, HAProxy, or Apache mod_proxy_fcgi) and worker sockets.
Prerequisites: Insecure pass-through of client-supplied headers into FastCGI environmental parameters (SCRIPT_FILENAME or PHP_ADMIN_VALUE), allowing arbitrary configuration overrides.
Remediation: Strict sanitization of FastCGI parameter dictionaries in fpm_main.c and rejection of injected delimiters.
The vulnerability potential spans PHP-FPM, Apache mod_php, CGI wrappers, FrankenPHP, LiteSpeed (LSPHP), and Docker containerized deployments.
/usr/bin/php, php-fpm, or container base image).Official upstream thresholds and Linux distribution-specific package version mappings.
| PHP Branch | Upstream Fixed Release | Recommended Action | Delivery Mechanism |
|---|---|---|---|
| PHP 8.5.x | 8.5.12 | Update to fixed release or later patched release | Normal Upstream Release |
| PHP 8.4.x | 8.4.27 | Update to fixed release or later patched release | Normal Upstream Release |
| PHP 8.3.x | 8.3.36 | Update to fixed release or later patched release | Normal Upstream Release |
| PHP 8.2.x | 8.2.35 | Update to fixed release or later patched release | Normal Upstream Release |
| PHP 8.1.x | No normal upstream release | Check vendor backports, PHP source backports and supported upgrade options | Source Backport / Vendor LTS |
| PHP 8.0.x | No normal upstream release | Check vendor backports, PHP source backports and supported upgrade options | Source Backport / Vendor LTS |
| PHP 7.4.x | No normal upstream release | Check vendor backports, PHP source backports and supported upgrade options | Source Backport / Vendor LTS |
| Older than 7.4 | Legacy unsupported runtime | Prioritize migration or a vendor-supported remediation path | Migration / WAF Isolation |
The PHP project has published minimal standalone source backports for PHP 8.1, 8.0, and 7.4 on GitHub. These allow organizations compiling from source to integrate the fix without upgrading major versions. These are not normal upstream binary releases, but they do provide direct patch code.
Furthermore, a Linux vendor’s package version may remain unchanged while containing a security backport. For example, on Ubuntu 24.04 LTS, the official patched package version is 8.3.6-0ubuntu0.24.04.13. While php -v still outputs "PHP 8.3.6", the binary is fully protected through the .13 Debian revision. Never declare a server vulnerable solely because its displayed upstream number is below the upstream threshold.
| Operating System | Default Branch | Verified Fixed Package Version | Official Security Notice |
|---|---|---|---|
| Ubuntu 24.04 LTS (Noble) | PHP 8.3 | 8.3.6-0ubuntu0.24.04.13 | USN Advisory (Canonical) |
| Ubuntu 22.04 LTS (Jammy) | PHP 8.1 | 8.1.2-1ubuntu2.20 | USN Advisory (Canonical) |
| Debian 12 (Bookworm) | PHP 8.2 | 8.2.26-1~deb12u1 | DSA Security Advisory |
| RHEL 9 / AlmaLinux 9 / Rocky 9 | PHP 8.0 / 8.1 | Check `dnf check-update php*` | RHSA Security Errata |
| Ondřej Surý PPA (Ubuntu/Debian) | All (5.6 - 8.5) | >= 8.3.36 / 8.2.35 / 8.4.27 | Deb.Sury.Org Repositories |
| Remi Collet RPM (Enterprise Linux) | All (7.4 - 8.5) | >= 8.3.36 / 8.2.35 (Remi Safe) | Remi's RPM Repository |
Evaluates your PHP runtime version, OS repository syntax, and vendor backport indicators locally in your browser. No server information or IP addresses are collected.
Verified upstream mirrors, official security bulletins, and national incident response links.
PHP Official Downloads
Upstream release tarballs, GPG signatures, and SHA256 checksums (8.2.35, 8.3.36, 8.4.27, 8.5.12).
PHP Source Repository (GitHub)
Access official git commits and standalone minimal backports for PHP 8.1, 8.0, and 7.4.
Ubuntu Official Guidance
Canonical security notices, USN revision identifiers, and apt update recommendations.
UK NCSC Security Guidance
National Cyber Security Centre operational recommendations for inventorying and isolating PHP workloads.
CERT-In Security Advisory Portal
Indian Computer Emergency Response Team directives for critical sector portals and data centers.
PHP Supported Versions Timeline
Official EOL roadmap, active support windows, and security-fix phase schedules.
php.net require compiling with appropriate development libraries, compiler toolchains, and modules. Server administrators should normally prefer signed, pre-compiled distribution packages provided by their operating system vendor or managed hosting provider.Detailed package manager commands, configuration checks, and service restart procedures.
Step 1: Check your currently running PHP CLI and FastCGI binary:
$ php -v$ dpkg-query -l 'php*' | grep -E '^ii'Step 2: Inspect repository candidate versions and changelog:
$ apt-cache policy php8.3-fpm$ apt-get changelog php8.3-fpm | head -n 25Step 3: Update package index and apply security upgrade:
$ sudo apt-get update$ sudo apt-get --only-upgrade install 'php*'Step 4: Restart active execution handler to reload libraries into memory:
$ sudo systemctl restart php*-fpm$ sudo systemctl restart nginx # or: sudo systemctl restart apache2Step 1: Inventory installed PHP RPM modules:
$ rpm -qa | grep -E '^php'$ dnf check-update 'php*'Step 2: Inspect security errata and changelog:
$ rpm -q --changelog php | head -n 30 | grep -E 'CVE-2026-10961[89]'Step 3: Apply vendor updates and restart PHP-FPM:
$ sudo dnf update 'php*'$ sudo systemctl restart php-fpmWarning: Simply restarting a container does not update its internal binaries if the base image tag is cached. You must pull the patched image and rebuild:
# Update Dockerfile to pin fixed upstream releases:FROM php:8.3.36-fpm-alpine# Or: FROM php:8.4.27-fpm-alpine$ docker pull php:8.3.36-fpm-alpine$ docker compose build --no-cache webapp$ docker compose up -d --force-recreate webapp$ docker exec -it $(docker ps -qf name=webapp) php -vStep 1: Download the official Windows binary zip from windows.php.net/download. For IIS FastCGI, choose the Non-Thread Safe (NTS) x64 build. For Apache with mod_php, select Thread Safe (TS) x64.
Step 2: Stop the World Wide Web Publishing Service in PowerShell:
Stop-Service W3SVCStep 3: Extract binaries over the target PHP installation folder (preserve existing php.ini), ensure Visual C++ Redistributable is updated, and restart:
Start-Service W3SVC& 'C:\Program Files\PHP\v8.3\php.exe' -vcPanel / WHM (EasyApache 4): Navigate to WHM > EasyApache 4. If CloudLinux or cPanel has published the patch, run yum update ea-php*. In MultiPHP Manager, ensure domains are assigned to patched handler versions. Restart Apache and PHP-FPM in Restart Services.
Plesk: Navigate to Tools & Settings > Updates and Upgrades. Select PHP components and apply available vendor package revisions. Restart PHP-FPM pools under Tools & Settings > Services Management.
If your hosting provider manages server packages without root SSH access, send this verification ticket through their support helpdesk:
Follow this 10-step protocol to prevent service disruption during emergency patching.
Obtain formal change approval and schedule emergency window during lowest active user traffic.
Execute snapshot or tar backup of /var/www, custom configurations, and SQL database dumps.
Identify every domain, active socket, extension, and third-party PHP library currently serving requests.
Verify application bootstrap, uploads, and database connectivity in staging before production upgrade.
Confirm repository keys and package signatures originate from verified distribution repositories.
Run package manager upgrade commands targeting PHP binaries and dependent extension modules.
Restart PHP-FPM or Apache. A binary updated on disk is not active until processes reload memory.
Test user login, file uploads, checkout, and API integrations against the newly running runtime.
Examine web access and error logs for abnormal multipart boundaries or prior exploitation attempts.
Document patch evidence, timestamp, responsible engineer, and close maintenance ticket.
Applying a security patch fixes the vulnerability against future exploit attempts. Patching does not automatically remove pre-existing persistence, web shells, unauthorized user accounts, or backdoors if a server was compromised prior to patch deployment. If exploitation is suspected, conduct a forensic investigation immediately.
Directives for departmental portals, Annual Maintenance Contract (AMC) vendors, NIC environments, and state data centers.
Government and public-sector portals often rely on long-standing infrastructure managed under third-party Annual Maintenance Contracts (AMC) or hosted in shared State Data Center (SDC) clusters. These operational realities introduce distinct risk profiles:
*.php files in upload folders) or anomalous outbound connections are detected, preserve volatile memory, take server snapshots, and escalate immediately to the designated departmental CISO and CERT-In.Standard compliance reporting matrix for departmental portals, AMC contractors, State Data Centers, and NIC environments.
| Department | Target Domain | Server ID | PHP Runtime | CVE Status | Closure Status |
|---|---|---|---|---|---|
| Dept of Transport | transport-portal.gov.example | VM-SDC-TRP-01 | PHP 8.3-FPM | Patched (8.3.6-0ubuntu0.24.04.13) | CLOSED / VERIFIED |
| State Education Board | results.edu.gov.example | HAPROXY-CLUSTER-02 | PHP 8.2-FPM | Patched (php-8.2.35-1.el9) | CLOSED / VERIFIED |
| Municipal Corporation | citizen-services.gov.example | VPS-CLOUD-NIC-04 | PHP 8.1 (Legacy) | Compensating Controls (WAF + Patch) | MONITORING |
Note: Completed forms must be archived with your department CISO, AMC contractor audit register, and made available for periodic national security compliance assessments.
How to verify successful remediation and audit logs for indicators of prior compromise.
# 1. Verify binary version:
php -v
# 2. Verify PHP-FPM service status and uptime:
systemctl status php*-fpm
# 3. Verify open sockets and active library mappings in memory:
lsof -i :9000 || lsof -U | grep php
1. Worker Segmentation Faults
Check kernel logs (dmesg or /var/log/syslog) for SIGSEGV or segfault errors in php-fpm processes.
2. Anomalous Child Processes
Check for unexpected child process execution spawned by www-data (sh, bash, curl, wget, nc).
3. Suspicious Upload Files
Audit media directories for newly created PHP scripts: find /var/www/uploads/ -name "*.php*" -mtime -7.
4. Scheduled Task Modifications
Verify web user crontabs: crontab -u www-data -l and check /etc/cron* for unauthorized additions.
Generate customized support requests, government circulars, and interpret terminal outputs according to official vendor security documentation.
Privacy & Operational Security Warning: Before pasting terminal output or server logs, redact private IP addresses, passwords, database credentials, authentication tokens, and private hostnames. The AI tool operates locally in your browser session.