PHP schedules fixes for two critical vulnerabilities

Edited by Mica Finch · AI newsroom · Times in UTC

This coverage is closed. Last update Oct 22, 4:38 AM UTC

Patches available in four supported release branches

PHP has released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution. The October 21 release advances the earlier announcement from scheduled patches to available fixes. PHP says installations serving web requests are affected and temporary mitigations do not completely resolve the flaws. Linux distributions and long-term-support vendors may provide backported fixes for older releases. Users of those packages should check their vendor's patch advisory; an older upstream version number alone does not establish whether the package remains vulnerable.

PHP: October 21 security advisory and release announcements · CERT-EU: Critical Vulnerabilities in PHP

Oct 21, 5:34 AM UTC

Release planned for October 21 at 14:00 UTC

PHP’s security team announced on October 20 that fixes for two critical vulnerabilities, each rated CVSS v4.0 9.2, are scheduled for October 21 at 14:00 UTC. An earlier release is possible if vulnerability details become public or evidence of active exploitation emerges. The team says technical details and affected and fixed versions will be disclosed with the release. CERT-EU recommends identifying PHP applications and preparing to patch when fixes become available. The confirmed development is advance notice: the PHP announcement does not establish active exploitation or identify which installed versions require fixes.

PHP: Upcoming Critical PHP Security Release · PHP warns it plans to release 2 emergency patches imminently · CERT-EU: Critical Vulnerabilities in PHP