Two Critical PHP Vulnerabilities and How to Find PHP With Defender

October 22, 2026 · Joe Stocker

On October 20th, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (here) to fix two critical vulnerabilities that can allow unauthenticated remote code execution. In plain terms, an attacker on the internet with no username and no password can run commands on a server running a vulnerable version of PHP. All PHP users are strongly encouraged to update immediately. Huntress has a technical write-up (here) if you want the details.

TL;DR, patch PHP now, starting with anything that faces the internet. If you run Microsoft Defender for Endpoint as your EDR, the two Advanced Hunting queries below will tell you which Windows endpoints have PHP on them and which of those Defender believes are internet-facing. Patch those first.

"We don't run PHP"

I hear this a lot, and it is usually wrong. PHP is commonly bundled inside other software such as content management systems, control panels, monitoring tools, and vendor applications, so it is often sitting in places that are not obvious and that nobody is patching. Your web team may not run PHP, but the appliance in the server room with a web console might.

That changes who has to ship the fix. If a vendor bundled PHP into their product, you are waiting on the vendor for an updated build, and you cannot wait on a vendor you do not know you depend on. So the first job is inventory, and the second job is priority.

What is at risk

  1. Remote Code Execution. An attacker could run commands on a server running a vulnerable PHP version, which can lead to compromise of the host and every application it serves.
  2. Follow-on activity. A compromised PHP process can be used to launch shells and interpreters, download tools, and run reconnaissance commands from inside your network. The web server becomes the attacker's foothold.
  3. Unpatched exposure. PHP versions outside the currently supported branches may not receive a fix at all. If you are still on PHP 7.x or an unsupported 8.x branch, there may be no patch coming for you.

Finding PHP with Defender Advanced Hunting

The two queries below are provided for environments where Microsoft Defender for Endpoint is deployed as the EDR solution. They are for educational purposes and come without warranty. They are written for the Advanced Hunting page in the Microsoft Defender portal. Test them in your own tenant and read the caveats section before you trust the results.

Query 1 looks back 30 days (the Advanced Hunting retention limit in the Defender portal) for any process whose parent was identified as PHP from "The PHP Group," and returns the most recent hit per device. That gives you a list of endpoints that actually ran PHP, not just endpoints with a php.exe sitting on disk.

Query 1: endpoints running PHP

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessVersionInfoProductName == "PHP" and
InitiatingProcessVersionInfoCompanyName == "The PHP Group"
| summarize arg_max(Timestamp, *) by DeviceId
| project-reorder Timestamp, DeviceId, DeviceName

Query 2 takes the same list of devices and joins it against the DeviceInfo table, keeping only the devices Defender has flagged as internet-facing. Those are the ones to patch first. Then patch the rest.

Query 2: which of those are internet-facing

let PHPDevices = DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessVersionInfoProductName == "PHP" and
InitiatingProcessVersionInfoCompanyName == "The PHP Group"
| distinct DeviceId;
DeviceInfo
| where Timestamp > ago(30d)
| where DeviceId in (PHPDevices)
| summarize arg_max(Timestamp, *) by DeviceId
| where IsInternetFacing == true
| project Timestamp, DeviceId, DeviceName, PublicIP, IsInternetFacing

Microsoft documents how the internet-facing classification works (here).

Caveats

Please read these before you take the results to your patching team.

  1. Windows only. Defender currently classifies only Windows devices onboarded to Microsoft Defender for Endpoint as internet-facing. For any non-Windows endpoint running PHP, such as Linux, your team will need to determine whether it is internet-facing using your in-house tools and your own knowledge of the environment, and verify it on the endpoint itself. Most PHP in the world runs on Linux, so this caveat matters.
  2. Based on observed activity. Defender flags a device as internet-facing when it sees external scans or inbound connections from the internet. If no new events are seen for 48 hours, the flag is removed. A device that is exposed but quiet may not appear in Query 2.
  3. Depends on your data. Both queries depend on the DeviceProcessEvents and DeviceInfo tables being populated by Microsoft Defender for Endpoint in your environment. No data, no results, and no results does NOT mean no PHP.
  4. Verify against your own controls. Confirm exposure against your own firewall and network security group rules. Treat the Defender flag as a starting point.

Recommendations

To reduce this exposure, I recommend the following:

  1. Inventory all PHP installations, including those bundled with vendor software, using Query 1.
  2. Prioritize internet-facing PHP endpoints, identified with Query 2, and apply the PHP security updates to them first. Then patch the remaining PHP endpoints, and check with your vendors for updated builds of any product that bundles PHP.
  3. Reduce direct internet exposure of PHP-backed systems by placing them behind a web application firewall or reverse proxy and restricting inbound web ports to the sources that actually need them.
  4. Isolate any end-of-life PHP from the internet, or put it behind a VPN or web application firewall, until it can be upgraded. If there is no patch coming, exposure control is the only control you have.
  5. If you find suspicious activity, isolate the server, preserve the web server and PHP logs, and review for webshells, new files in the web root, and new scheduled tasks or accounts.

Disclaimer: This is for educational purposes only, without warranty. You assume all risk for testing these queries in your lab first before relying on them in production.

Sources

Need help finding PHP in your environment, or someone to run these queries against your tenant and hand you the patch list? Email us at Hello At PatriotConsultingTech.com

About the author. Joe Stocker is the Founder and Chief Technical Officer of Patriot Consulting, a former Microsoft Security MVP (2020-2026), and author of the book "Securing Microsoft 365." In his spare time Joe volunteers with several Microsoft programs including Microsoft's Defending Democracy (AccountGuard) program, Microsoft Tech for Social Impact, and the Microsoft Software and Systems Academy (MSSA), which serves military service members desiring to transition into the civilian workspace.

Note: The author created this article with assistance from AI. Learn more