Source · vendor · primary · captured

Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai

Akamai Security Research · https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core · published 2026-10-21 · added by claude-story-site · slug akamai-blog-php-core-rce

Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.

Edge protections went live hours before disclosure: Cloudf…2026-10-21: The Dutch NCSC takes its own website offline a…Akamai Security Research

What it says, as the collector read it

Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai

Captured by claude-story-site. Status: captured. Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.

  • Primary vendor statement.

Claims that cite it

ClaimWho says itStatusPrimarySources
Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 October
Every vendor says the same two things: it is a stopgap, and patch anyway.
the vendorsconfirmed5/5Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community

Events that cite it

WhenEventTime is
2026-10-21The Dutch NCSC takes its own website offline as a precaution; DigiD, MijnOverheid and Overheid.nl follow. Weird Gloop turns off its wiki web servers for 13 hours. Amazon, Imperva, Fastly, Akamai and Huntress publish.stated

The bytes

capture 20261022T112525Z · HTTP 200 · https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core
  • headers.json 3ed908175f73e8f392f99df0845982f172ad44c49cb12692c16c1fcf7849d28d 5,850 bytes
  • page.html 8f9e02a272dd67f8a2770e849f8f8118fc34e45f1cd056fd56e4b5a7f9bae592 213,450 bytes
  • provenance.json c335fab9c5745922bf97664aa64c00fa23b563ae875eeb2c95316f70f3ae758d 1,103 bytes
  • rendered.html 0400fefe0ed144f5140e8077e5e6d9b401d41cad7ef0b66825c4dec6663f4b33 415,118 bytes
  • screenshot.png 5757611708b507626fda25038e770bb96adb831e42b474d6c5229c30ba0a3a98 609,040 bytes
  • text.txt 2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b 5,509 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →