Patch Forecast
Amber warning
Patch this week.

CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN…

Risk score
71/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the appli…
Affected
PHP
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Public proof of concept

Story map

Story map: PHP2ShellTHE FLAWSTHE FIXCVE-2026-17545On Windows, PHP's filesystemand stream APIs do not rejectreserved device names such as…CVSS 7.5 · EPSS 0%CVE-2026-109618Use-after-free can lead toremote code executionCVSS 9.8 · EPSS 12%CVE-2026-109619PHP has various global statethat temporarily points intorequest memoryCVSS 8.1 · EPSS 6%CVE-2026-91765Denial of serviceCVSS 7.5 · EPSS 1%FixCheck the linked advisory for afix, as none is provided in therecord.Who is exposed{'products': ['PHP'], 'packages':[], 'versions': ['all versions']}RED · ACT TODAYPHP2ShellPHP uses longjmp() forout-of-memory (OOM) errors,which can lead to remote codeexecution (RCE). An attackercould exploit this vulnerability toexecute arbitrary code on atargeted system.Where it standsExploitation reported in the press6 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.24 Sep · PHP releasesPHP 8.3.35 Released!24 Sep · PHP releasesPHP 8.5.11 Released!21 Oct · The Hacker NewsPHP2Shell: Two Unpatched Critical PHP RCE Flaws(CVSS 9.2) Trigger Emergency Security Alert21 Oct · Infosecurity MagazineCritical PHP Vulnerabilities Leaked Ahead ofScheduled Security Patches21 Oct · CISA advisories (US)Critical Vulnerabilities in PHP Require ImmediatePatching21 Oct · Ubuntu security noticesUSN-8948-2: PHP vulnerabilities21 Oct · PHP releasesPHP 8.6.0 RC4 available for testing23 Oct · PHP releasesInformational advisory: Session upload progress23 Oct · SecurityWeekMirai Botnet Operators Join PHP2Shell Attacks asASLR Bypass Exploits Emerge23 Oct · BleepingComputerPHP shares mitigation for new RCE vulnerabilitywith no patch23 Oct · Dark ReadingExposed to PHP2Shell? Cyber Experts Weigh in WithAdvice25 Oct · Help Net SecurityWeek in review: PHP vulnerabilities patched,exploited Palo Alto GlobalProtect VPN flawCONNECTS TOSame weaknessCWE-67 (CWE-67)1 other warning in 30 days →Same productEarlier PHP warnings7 in the last 90 days →Reported alongsidePHP: with the next releaseCVE-2026-115560 · in 1 of the samearticle →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.

The flaws

  • CVE-2026-17545: On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
  • CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
  • CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Fix: Check the linked advisory for a fix, as none is provided in the record.

Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}

Where it stands

  • Exploitation reported in the press
  • 6 outlets covering it

How it unfolded

  1. 24 Sep, PHP releases (official): PHP 8.3.35 Released!
  2. 24 Sep, PHP releases (official): PHP 8.5.11 Released!
  3. 21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
  4. 21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
  5. 21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
  6. 21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
  7. 21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
  8. 23 Oct, PHP releases (official): Informational advisory: Session upload progress
  9. 23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  10. 23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
  11. 23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
  12. 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: php

References

Original description

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

Last activity 25 Sep 2026. Patch Forecast updates every hour.