PHP Discloses Unpatched RCE in Non-Default Configurations, Shares Interim Mitigations

What happened

According to BleepingComputer, the PHP security team has disclosed a new remote code execution (RCE) vulnerability that currently has no official patch. The flaw reportedly only affects systems running non-default configurations, and PHP has published mitigation guidance in lieu of a fix.

Specific technical details — the vulnerable component, affected PHP versions, a CVE identifier, and the exact configuration settings involved — were not included in the available reporting at the time of writing.

Why it matters

RCE flaws in PHP are high-impact by nature, since PHP underpins a large share of web applications and CMS platforms. The fact that this issue lacks a patch means affected organizations must rely on configuration-based mitigations until a fix ships, which raises the risk of inconsistent remediation across environments — especially where non-default settings were applied for legacy, performance, or compatibility reasons and may not be well-documented.

Because the vulnerability is scoped to non-default configurations, exposure will vary significantly between deployments. Teams running custom PHP configurations (e.g., altered `php.ini` directives, non-standard extensions, or atypical handler setups) should treat this as a priority to investigate, while standard/default installations may be unaffected.

What defenders should do now

• Review your PHP configuration against PHP's official advisory and mitigation guidance as soon as it's published in full, rather than assuming default settings protect you.
• Inventory which PHP services run non-default or custom configurations, particularly internet-facing applications, to prioritize review.
• Until a patch is available, apply the vendor's recommended interim mitigations and consider compensating controls such as WAF rules, restricting outbound/inbound access to PHP services, and monitoring for anomalous process execution spawned from PHP-FPM, Apache, or Nginx worker processes.
• Watch logs for unexpected child processes, unusual file writes, or outbound connections originating from web server/PHP-FPM processes, which can indicate RCE exploitation attempts.
• Track the PHP security advisory for a forthcoming patch and apply it promptly once released.

Developing story

This is based on early reporting and PHP's own mitigation guidance; full technical details (affected versions, exact configuration triggers, and any CVE assignment) had not been confirmed in the source at publication time. We will revisit this item as more information becomes available. Read the original report at BleepingComputer.