PHP Emergency Patch for Two CVSS 9.2 RCE Flaws Leaves 884k Legacy Hosts Exposed

The leak on Hacker News October 20 disclosed CVSS 10.0 scores and the two CVE numbers but no technical details or affected versions. watchTowr confirmed the embargoed flaws were real and would allow RCE, prompting PHP to accelerate its release by one day. Shodan data from Mallory shows 884000 internet-facing hosts still banner as PHP 8.1 or older, representing 59 percent of version-reporting systems and receiving no vendor patch.

PHP's notice omits configuration requirements, exploit primitives, and the full affected range, leaving operators without workarounds until the changelog lands. The claim that flaws reach back to PHP 5 remains unconfirmed by any vendor advisory. End-of-life branches 8.1 and earlier, plus bundled instances in cPanel, Plesk, and vendor appliances, create a permanent exposure surface that distribution backports cannot address.

Historical patterns with prior PHP RCEs such as CVE-2019-11043 show that public details trigger scanning within hours and mass exploitation within days on unpatched hosts. The absence of independent technical attribution or in-the-wild evidence does not reduce the systemic risk created by the 740000 additional hosts reporting PHP without version strings.

Operators must inventory every PHP binary, prioritize internet-facing upgrades, and plan migrations off EOL branches before the next disclosure cycle. No coordinated industry response exists beyond individual patching.