New Serious PHP Vulnerabilities Released and Patched
PHP maintainers shipped emergency fixes for two critical unauthenticated RCE flaws across all active branches — given PHP's dominance in European web infrastructure, this is a patch-now event.
Summary written by editorial AI · Source link below
PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can tr
Editorial Analysis
PHP powers a massive share of European web applications; unauthenticated RCE across all supported versions is a mass-exploitation scenario waiting to happen if patching lags.
Patch all PHP installations to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately and verify no public-facing servers remain on vulnerable versions.
Critical PHP vulnerabilities allow unauthenticated remote takeover of web servers — immediate patching is essential.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Schneier on Security in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d