New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released two critical vulnerabilities: PHP 8. 5. 12, 8. 4. 27, 8.

3. 36 and 8. 2. 35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities:...