I'm sure you're getting a lot of bug reports with ChatGPT, Claude, etc. evaluating and requesting a fix.. Here's another one.. haha

We recently upgraded a site from EE 5 to EE 7, switching from PHP 7.4 to PHP 8.3.

We also enabled PHP error reporting tools that report issues alerts (emails) to us when there are PHP errors.

Here is the error emails we are receiving.. and below that is the codex review that suggests some adjustments to be made in the EE files for PHP 8.x fixes.

Our Email report:

Fatal PHP error detected.
Type: 1
Message: Uncaught Error: Undefined constant "REQ" in
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/legacy/core/Exceptions.php:144](/httpdocs/admin/ee/legacy/core/Exceptions.php:144)
Stack trace:
#0
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/ExpressionEngine/Boot/boot.common.php](/httpdocs/admin/ee/ExpressionEngine/Boot/boot.common.php)(346):
EE_Exceptions->show_error()
#1 /var/www/vhosts/[domain redacted]/httpdocs/admin/ee/legacy/core/URI.php](/httpdocs/admin/ee/legacy/core/URI.php)(275):
show_error()
#2 /var/www/vhosts/[domain redacted]/httpdocs/admin/ee/legacy/core/URI.php](/httpdocs/admin/ee/legacy/core/URI.php)(220):
EE_URI->_filter_uri()
#3
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/legacy/core/Router.php](/httpdocs/admin/ee/legacy/core/Router.php)(105):
EE_URI->_explode_segments()
#4
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/ExpressionEngine/Legacy/App.php](/httpdocs/admin/ee/ExpressionEngine/Legacy/App.php)(61):
EE_Router->_set_routing()
#5
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/ExpressionEngine/Core/Core.php](/httpdocs/admin/ee/ExpressionEngine/Core/Core.php)(85):
ExpressionEngine\Legacy\App->overrideRouting()
#6
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/ExpressionEngine/Boot/boot.php](/httpdocs/admin/ee/ExpressionEngine/Boot/boot.php)(131):
ExpressionEngine\Core\Core->overrideRouting()
#7 /var/www/vhosts/[domain redacted]/httpdocs/index.php](/httpdocs/index.php)(164): require_once('...')
#8 {main}
thrown
File:
/var/www/vhosts/[domain redacted]/httpdocs/admin/ee/legacy/core/Exceptions.php](/httpdocs/admin/ee/legacy/core/Exceptions.php)
Line: 144

Request:
URL: /wedding-monogram/HttP:%2f%2fbxss.me%2ft%2fxss.html%3f%2500
Method: POST
IP: 172.93.111.190
User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
360SE)
Referrer: none
Script: /var/www/vhosts/[domain redacted]/httpdocs/index.php](/httpdocs/index.php)
Query:
Response Code: 500
Memory Peak: 16777216
Time: 2026-05-07T12:35:39-07:00
POST: Array
(
[ACT] => 25
[RET] => wedding-monogram/veronica-monogram
[_params] =>
QtDoNu/JOdZGxIOTcHJQhPrLF/oJd/aXtoxCjDzVCjZC56bknYsEWBFJfLW8tIrT3YNLiRwUtcMQkHUnypjvsvywA2iymcL2RB/u5X8aVLs=
[csrf_token] => [redacted]
[entry_id] => 10461
[item_qty] => 1
[modifiers_2526] => 1
[modifiers_2530] => Veronica Monogram
[modifiers_2539] => 15286
[nosubmit] => 1
[return_url] => /cart
[site_id] => 1
[submit] =>
)

Codex response:

That request is almost certainly automated XSS probing. The URL contains
HttP:%2f%2fbxss.me%2ft%2fxss.html, which decodes toward a blind-XSS test URL.
ExpressionEngine catches that in URI.php (line 272): it decodes %2f/%3a, sees
http://, and calls show_error('The URI you submitted has disallowed
characters.', 400) at URI.php (line 275).

The 500 email is the secondary problem: EE tries to render that controlled 400
error, but Exceptions.php (line 144) checks if (REQ == 'CLI') before REQ has
been defined for this frontend request. On PHP 8+, an undefined constant is
fatal, so the intended “bad URI” response becomes a PHP fatal.

So: yes, this looks like a blocked malicious/noisy probe, not a successful
exploit. But it also reveals a real error-handling bug/noise source. The clean
fix is to guard those REQ checks, e.g. defined('REQ') && REQ === 'CLI',
especially in Exceptions.php lines 85, 144, and 320. That should turn these
alerts back into boring 400 responses instead of fatal-error emails.