Zabbix Statement on Recently Reported PHP Security Vulnerabilities

October 22, 2026. Zabbix, the open source, enterprise-class observability solution, is aware of the recently reported critical PHP vulnerabilities that could potentially allow unauthenticated remote code execution (RCE).

PHP is used by the Zabbix frontend but is a separate software dependency and is not included in Zabbix packages. As a result, the security of PHP installations depends on the versions deployed and the security updates provided by the relevant PHP or operating system vendor.

Zabbix recommends that users review the relevant PHP security advisories and apply the appropriate security updates in accordance with the remediation guidance provided by their PHP or server operating system vendor. Particular priority should be given to internet-facing PHP deployments to help minimize potential security risks.

For further information and remediation guidance, please consult the official PHP Security Advisory and the security advisories published by your server operating system vendor.

If you have any questions or require further clarification regarding Zabbix, please contact the Zabbix team.

About Zabbix

Established in 2005, Zabbix LLC is a global software development company with over 250 partners around the world as well as a large portfolio of customers in a variety of industries. The company's flagship product is Zabbix, an enterprise-class, open-source distributed monitoring solution designed to monitor and track the performance and availability of network servers, devices, services, and other IT resources.

Zabbix LLC also provides a wide range of commercial services such as technical support, Zabbix integration, implementation, and customized development services as well as Zabbix professional training. The company's newest offering, Zabbix Cloud, offers the entire range of Zabbix features with easier deployment and management, enhanced scalability, and automatic upgrades.

Website: www.zabbix.com