PHP RCE Vulnerabilities: Volker Dusch on the Disclosure | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://msaied.com) - [Home](https://msaied.com) - [Projects](https://msaied.com/projects) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [About](https://msaied.com#about) [ Contact](https://msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://msaied.com) - [ProjectsCase studies](https://msaied.com/projects) - [ArticlesEngineering notes](https://msaied.com/articles) - [CertificatesCredentials](https://msaied.com/certificates) - [AboutHow I work](https://msaied.com#about) - [ContactGet in touch](https://msaied.com#contact) [Start a conversation](https://msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://msaied.com) 2. / 3. [Articles](https://msaied.com/articles) 4. / 5. [PHP](https://msaied.com/articles?category=php) 6. / 7. Volker Dusch on the PHP RCE Vulnerabilities and Disclosure [PHP](https://msaied.com/articles?category=php) Volker Dusch on the PHP RCE Vulnerabilities and Disclosure =========================================================== Volker Dusch of the PHP Foundation's Ecosystem Security Team breaks down how the critical PHP RCE vulnerabilities were found, why coordinated disclosure is hard, and what the broken embargo means for the PHP community. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://msaied.com#person) Published 23 Oct 2026 · Updated 27 Oct 2026 · 4 min read ShareCopy linkCopied ![Volker Dusch on the PHP RCE Vulnerabilities and Disclosure](https://cdn.msaied.com/807/5d78d8a7c09c6847fd813a03863ea3fa.png) On this page +1. [Inside the PHP RCE Disclosure: A Conversation with Volker Dusch](#inside-the-php-rce-disclosure-a-conversation-with-volker-dusch) 2. [How the Vulnerabilities Were Found](#how-the-vulnerabilities-were-found) 3. [Why Patching PHP Takes Longer Than a Browser Update](#why-patching-php-takes-longer-than-a-browser-update) 4. [The Broken Embargo](#the-broken-embargo) 5. [Fake Proofs of Concept](#fake-proofs-of-concept) 6. [The Session Upload Progress Advisory](#the-session-upload-progress-advisory) 7. [Who Did the Work](#who-did-the-work) 8. [Key Takeaways](#key-takeaways) Inside the PHP RCE Disclosure: A Conversation with Volker Dusch --------------------------------------------------------------- Eric L. Barnes sat down with [Volker Dusch](https://github.com/edorian) for the Laravel Creator Series to unpack this week's [critical PHP security releases](https://laravel-news.com/php-critical-rce-security-releases). Volker works at [Tideways](https://tideways.com) and serves as AI Security Engineer in Residence on the PHP Foundation's [Ecosystem Security Team](https://laravel-news.com/the-php-foundation-launches-an-ecosystem-security-team). He was directly involved in coordinating the fixes. How the Vulnerabilities Were Found ---------------------------------- The PHP Foundation got PHP included in OpenAI's [Patch the Planet](https://openai.com/index/patch-the-planet/) program. Security firm [Calif](https://calif.io/) began auditing PHP as part of that initiative and quickly reached out to Volker asking to meet urgently — they already had a minimal exploit running inside a Docker container. Once the PHP security team reviewed it, there was no doubt it was real. OpenAI and Wiz subsequently reported additional attack vectors sharing the same root cause. Why Patching PHP Takes Longer Than a Browser Update --------------------------------------------------- The PHP project ships **source code**, not the binary you actually install. Before a fix reaches your server it must travel through: - Debian, Ubuntu, and Red Hat package maintainers - Official Docker Hub images - Downstream images built on top of those Because of the severity, the team also coordinated backports for PHP versions that are no longer officially supported. Cloud hosts the team lacked direct contacts with were reached through OpenAI and Wiz. Web application firewall vendors — including Cloudflare — were brought in early so they could ship protective rules before the public release date, providing a safety net for sites that couldn't patch immediately. The Broken Embargo ------------------ Distributors received the patch ahead of the coordinated release date so their users could update the moment the vulnerabilities went public. [Chainguard broke that embargo](https://phpnews.net/chainguard-php2shell-embargo) by publishing patched images more than six hours early. Volker's take was blunt: > It is a rough sell to say you're working on security if you leave most of the people exposed. He also noted that today it is far easier to reverse-engineer a patch — or even a compiled binary — into a working exploit, which makes early disclosure significantly more dangerous than it once was. Fake Proofs of Concept ---------------------- Several exploit screenshots circulated on social media in the days following the release. Volker checked a number of them and found they only worked against Docker containers that had been specially modified beforehand — they had no effect against the default Docker Hub image. The Session Upload Progress Advisory ------------------------------------ PHP published a [follow-up advisory](https://phpnews.net/php-session-upload-progress-rce) recommending that operators set: ```ini session.upload_progress.enabled=0 ``` until the next regular bugfix release. This setting was already listed as a mitigation in Wednesday's original advisory. If you applied it then, no further action is required. Volker described the conditions for this secondary issue as very particular and minor compared to the primary vulnerabilities. Who Did the Work ---------------- Volker credited Ilija, Arnaud, and Jakub — PHP Foundation-funded engineers who spent days and nights working through PHP's C codebase. The bug pattern could appear in many locations, so every single instance had to be found and fixed: > We have to fix every place where this happens. Every place means if we miss one it's a problem. Because those developers are employed full time by the PHP Foundation, the team could drop everything else and focus entirely on the response. Volker encouraged companies that build on PHP to consider [sponsoring the Foundation](https://thephp.foundation/sponsor/): > If you make a ton of money off of building apps on top of PHP, giving back just a tiny fraction of that is very useful. Key Takeaways ------------- - The vulnerabilities were discovered through OpenAI's Patch the Planet program via a third-party audit by Calif. - PHP's source-code distribution model means fixes must propagate through multiple OS and container image pipelines before reaching production servers. - WAF vendors like Cloudflare received early access to ship protective rules before the public release. - Chainguard broke the coordinated embargo by over six hours, increasing exposure risk. - Many circulating PoC screenshots were ineffective against unmodified Docker Hub images. - Setting `session.upload_progress.enabled=0` addresses the follow-up advisory; no extra action needed if you already applied Wednesday's mitigations. - Full-time PHP Foundation engineers made the rapid, thorough response possible. --- *Source: [Volker Dusch on the PHP RCE Vulnerabilities and Disclosure — Laravel News](https://laravel-news.com/volker-dusch-php-rce-disclosure)* - [PHP Security](https://msaied.com/articles?search=PHP%20Security) - [RCE](https://msaied.com/articles?search=RCE) - [PHP Foundation](https://msaied.com/articles?search=PHP%20Foundation) - [Vulnerability Disclosure](https://msaied.com/articles?search=Vulnerability%20Disclosure) - [Laravel Security](https://msaied.com/articles?search=Laravel%20Security) Frequently asked questions --------------------------- Do I need to take any action for the PHP session upload progress advisory?Only if you haven't already applied Wednesday's mitigations. The follow-up advisory recommends setting `session.upload\_progress.enabled=0` in your php.ini until the next regular bugfix release. If you applied that setting as part of the original advisory, no further action is needed. Why does it take longer to patch PHP than to update a browser?PHP ships source code, not a ready-to-install binary. A fix must be packaged by Debian, Ubuntu, Red Hat, and other distributors, then flow into official Docker Hub images and any downstream images built on top of them before it reaches your server. Were the PHP RCE exploit screenshots circulating on social media real?Most were not reliable. Volker Dusch checked several and found they only worked against Docker containers that had been specially modified in advance, and had no effect against the default, unmodified Docker Hub PHP image. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleDecide with Jev Episode 3: Turn AI Answers into Decisions with PHP Rules](https://msaied.com/articles/decide-with-jev-episode-3-turn-ai-answers-into-decisions-with-php-rules) On this page ------------- 1. [Inside the PHP RCE Disclosure: A Conversation with Volker Dusch](#inside-the-php-rce-disclosure-a-conversation-with-volker-dusch) 2. [How the Vulnerabilities Were Found](#how-the-vulnerabilities-were-found) 3. [Why Patching PHP Takes Longer Than a Browser Update](#why-patching-php-takes-longer-than-a-browser-update) 4. [The Broken Embargo](#the-broken-embargo) 5. [Fake Proofs of Concept](#fake-proofs-of-concept) 6. [The Session Upload Progress Advisory](#the-session-upload-progress-advisory) 7. [Who Did the Work](#who-did-the-work) 8. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/805/a4dfa0e7c7e3c01fb99f0f970866675b.png) AI · 3 min read### Decide with Jev Episode 3: Turn AI Answers into Decisions with PHP Rules 23 Oct 2026 ](https://msaied.com/articles/decide-with-jev-episode-3-turn-ai-answers-into-decisions-with-php-rules) [ ![](https://cdn.msaied.com/806/7655717eef251177fe662e2802c93d39.png) Laravel · 4 min read### Laravel Read Replicas: Prevent Stale Reads After a Write 22 Oct 2026 ](https://msaied.com/articles/laravel-read-replicas-prevent-stale-reads-after-a-write) [ ![](https://cdn.msaied.com/804/adc0feaa0650d379192acac1e92a111e.png) Laravel · 4 min read### Skuul: Open-Source School Management Built on Laravel 13 and Livewire 4 21 Oct 2026 ](https://msaied.com/articles/skuul-open-source-school-management-built-on-laravel-13-and-livewire-4) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://msaied.com) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://msaied.com/sitemap.xml)