RDAPLookup

By RDAPLookup Editorial TeamPublished October 22, 2026 · Last reviewed October 22, 2026

October 2026 PHP vulnerabilities: reported impact on RDAP services

Two critical PHP vulnerabilities prompted emergency patching. This maintained article records publicly reported RDAP service impacts, starting with BookMyName's precautionary shutdown and restoration.

On this page
  1. Reported RDAP service impacts
  2. What the PHP advisory says
  3. Other PHP-based RDAP implementations warrant checking
  4. BookMyName: precautionary shutdown and restoration
  5. What RDAP operators and users should do
  6. Review scope and updates
  7. Sources

PHP released fixes for two critical remote code execution vulnerabilities on October 21, 2026. The response has affected RDAP availability: Scaleway reported taking BookMyName services offline as a precaution while applying patched PHP versions, then explicitly confirmed that its RDAP services were back up.

This article tracks reported RDAP service impacts related to CVE-2026-109618 and CVE-2026-109619, with additional services added as public evidence becomes available.

Last reviewed: October 22, 2026, 13:49:13 UTC (UTC+0).

Reported RDAP service impacts

BookMyName is the only provider for which we identified an operator notice explicitly confirming related RDAP disruption within the review scope below.

Operator RDAP base URL Reported impact Recovery reported by operator Source
BookMyName / Scaleway SAS https://rdap.bookmyname.com/ Precautionary shutdown during emergency PHP security maintenance on October 21, 2026 RDAP back up at 18:40 CEST on October 21; overall incident resolved at 11:00 CEST on October 22 Scaleway incident updates

BookMyName’s notice confirms an availability impact during precautionary patching. It does not establish the patch status of a specific RDAP runtime or report successful exploitation.

What the PHP advisory says

The PHP security advisory describes two vulnerabilities that can allow unauthenticated remote code execution:

  • CVE-2026-109618, out-of-memory corruption: out-of-memory handling can interrupt initialization of internal request data. Request cleanup may then treat partially initialized data as valid.
  • CVE-2026-109619, stale global state: internal state belonging to one request can outlive its backing memory. A later request handled by the same worker may use that stale state.

PHP identifies all PHP installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit can trigger before application code runs.

The fixes shipped in these releases:

PHP branch Security release containing the fixes
8.2 8.2.35
8.3 8.3.36
8.4 8.4.27
8.5 8.5.12

Distribution and LTS vendors may provide backported fixes in packages with different version numbers. PHP 8.1 and older no longer receive regular updates from the PHP project. The advisory links minimal source backports for PHP 7.4, 8.0 and 8.1, but these do not restore support for those branches.

These are PHP runtime vulnerabilities, not flaws in the RDAP protocol.

Other PHP-based RDAP implementations warrant checking

RDAP services running vulnerable PHP may be affected, but exposure depends on the implementation, PHP version and configuration.

For example, the RDAP.org bootstrap server’s project repository describes its implementation as PHP using OpenSwoole. RDAP.org redirects queries to the appropriate RDAP service rather than supplying the registry’s registration record itself.

The repository documents the implementation, not its deployed PHP version, vendor patch status or configuration. It does not establish that RDAP.org is vulnerable or disrupted, so RDAP.org is not listed as a confirmed impact.

BookMyName: precautionary shutdown and restoration

Scaleway’s BookMyName security-maintenance report provides this timeline. All times below are CEST (UTC+2).

  • October 21, 15:50: the reported start of the interruption. In its notice posted at 16:06, Scaleway said all BookMyName services were unavailable and that it had taken them offline as a precaution while applying the patched PHP versions.
  • October 21, 18:40: the restoration time given in an update posted at 18:51. Scaleway stated: “The BookMyName website, its webmail, and the RDAP services are back up.” The redirection service remained down at that point.
  • October 22, 11:00: Scaleway marked the overall incident resolved. This is later than the reported RDAP restoration, not the end of the RDAP interruption.

Where the BookMyName endpoint is listed

The IANA Registrar IDs registry lists https://rdap.bookmyname.com/ for Scaleway SAS, registrar ID 74.

That is a separate source from IANA’s DNS RDAP bootstrap registry, which maps domain suffixes to registry services. A registrar endpoint does not need its own TLD bootstrap entry. Its absence from a TLD-discovery dataset is not evidence that the endpoint is unofficial. Our RDAP server discovery guide explains the initial registry-discovery process.

What RDAP operators and users should do

If you operate a PHP-based RDAP service, verify the PHP runtime that handles web requests, not just the command-line version. Check your distribution or hosting vendor’s advisory and installed package release, apply the fixes, and restart or replace affected workers so they run the patched code. Confirm the deployment across every instance serving the endpoint.

PHP says only an update is a complete solution. Its advisory includes temporary measures that reduce exposure to specific attack paths, but those measures do not make an installation safe. Follow the current upstream and vendor guidance rather than treating a configuration workaround as a completed fix.

If you use an RDAP service, check the operator’s status notice before interpreting a failed lookup as a missing registration record. Keep the responding service and retrieval time with your results. A registry response and a registrar response are separate sources; the availability of one does not establish the availability of the other. For general troubleshooting, see why an RDAP lookup fails in a browser.

Review scope and updates

The review combined public web searches pairing RDAP with CVE-2026-109618, CVE-2026-109619 or PHP2Shell and direct checks of these sources:

This is a review of public reports, not an exhaustive survey of RDAP operators or an audit of deployed runtimes. Unlisted services remain unassessed; their absence does not establish that they were unaffected or patched.

New entries will identify the operator and endpoint, link to the supporting notice, and record the reported impact and recovery separately. A hosting incident without evidence of RDAP impact will not be treated as an affected RDAP service. Exposed PHP version headers alone will not be treated as proof of vulnerability because vendors may backport fixes.

Update history

  • October 22, 2026: initial publication, recording BookMyName’s reported RDAP interruption and restoration and the PHP project’s security guidance.
  • October 22, 2026: added sourced implementation context for RDAP.org’s PHP/OpenSwoole bootstrap server, separate from confirmed service disruptions.
  • October 22, 2026, 13:49:13 UTC: rechecked the primary sources above, documented the review scope and consolidated the qualifications around reported impacts.

Sources

Back to top