Unverified50% confidenceFactExact time
There is a window of about 24 hours between the leak of the CVE IDs and the patch release, during which sites running PHP 8.x face increased exposure risk.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAccording to the timeline disclosed on Wiz's official blog: the first vulnerability was discovered on August 19, the exploitability of unauthenticated RCE on Drupal and WordPress was confirmed on August 20 and 21 respectively, and it was reported to the PHP security team on August 24.66% similarUnverifiedPHP officially released a security update on October 21, 2026 covering the entire PHP 8.x series, fixing two vulnerabilities that can lead to remote code execution.64% similarUnverifiedPHP's enormous installed base and large number of outdated versions that are not updated in time make the potential spread of such vulnerabilities extremely fast.63% similarUnverifiedAccording to statistics from security firms including Mandiant, the average time from public vulnerability disclosure to exploitation in the wild has shrunk from weeks to days, with some high-severity vulnerabilities being exploited on the day of disclosure.61% similarUnverifiedCVE-2026-1731 is an unauthenticated OS command injection in BeyondTrust Privileged Remote Access, autonomously discovered by a third-party research agent, and within four days of disclosure a threat cluster was exploiting it, with another five clusters carrying out post-exploitation within seven days.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1082898API
curl https://kongchang.com/api/v1/knowledge/claims/1082898MCP
get_claim(id=1082898)