SANS Internet Storm Center returned its Infocon alert level to Green

SANS Internet Storm Center returned its Infocon alert level to Green on the morning of Oct. 23, 2026, after determining that the immediate emergency phase had passed.

SANS had raised its Infocon level for a PHP-related security issue that demanded immediate attention. Patch releases came from many vendors working with php.net, and PHP developers issued fixes on Wednesday. SANS said coordinated disclosure worked and produced tested patches quickly, although some vendors shared details early and did not follow disclosure rules.

Cloudflare and Amazon reported exploit attempts, and Amazon detected an attempt against PHP coming from an anonymous internet address linked to a likely bad actor. Whether those attempts were real working exploits is unclear. Johannes B. Ullrich said he knew of no reliable exploit that had appeared publicly, although firms said they possessed working exploit code. He expects working exploit code to reach the public eventually.

SANS said applying the patch remains the most dependable defense. Groups that cannot patch should keep vulnerable applications separate, and workarounds are available though none are fully effective. Web application firewall rules might buy time. php.net said to keep using the session.upload_progress.enabled=0 workaround, a PHP configuration setting, until the next update.

SANS still has more patching to do on PHP. Ullrich told defenders to rest and step away instead of remaining on alert too long. Many embedded devices and appliances are still unpatched or may never get patches. Routers, storage systems, cameras and similar appliances should stay off the internet and remain on internal networks.

SANS said the flaw serves as a dress rehearsal for upcoming releases and exploits that show less responsibility. Partial exploits are already public, and some could be parasitic, targeting anyone who runs them. The danger is genuine even though widespread exploitation has not yet appeared, though widespread exploitation is still expected and only postponed. Node.js and Fortinet belong to other issues possibly missed that week.

Information Week said AI found a critical PHP vulnerability during the week of Oct. 19-23, 2026, and that European government agencies briefly shut down websites after AI found PHP vulnerabilities. PHP is a scripting language used to run websites, and it has been around for more than 30 years. AI has fundamentally altered the patching process because of how quickly it finds and exploits vulnerabilities, and security leaders must rework vulnerability management to keep up with AI. AI can assist IT executives in scanning for misconfigurations and overbroad permissions, then triaging vulnerabilities.