PHP Foundation limits RCE patches to versions 8.2 and newer

The PHP Foundation has disclosed two serious vulnerabilities that allow remote code execution, but official patches are only available for PHP 8.2 and later versions. This limited support scope leaves many legacy deployments without a direct path to remediation from the primary maintainer.

According to a report by Wired, the foundation’s decision means that organizations running older versions of PHP must rely on third-party vendors for security fixes. The vulnerabilities impact millions of websites globally, creating a significant exposure window for those unable to upgrade their software infrastructure immediately.

Context and Background

The disclosure highlights a growing challenge in maintaining security for widely used open-source software. The PHP Foundation has chosen to focus its patching efforts on current and supported versions, specifically PHP 8.2 and newer. This strategy aligns with standard industry practices but leaves a large base of older installations vulnerable.

Security experts have issued warnings regarding the severity of these flaws. The remote code execution nature of the vulnerabilities means that attackers could potentially take control of affected servers. Experts emphasize that failure to address these issues promptly could lead to dire consequences for website owners and their users.

Who Is Affected

Millions of websites are potentially affected by these two serious vulnerabilities. The impact is particularly severe for legacy deployments that have not upgraded to PHP 8.2 or newer versions. These organizations are now dependent on third-party vendors to provide backported fixes or alternative security measures.

The PHP Foundation’s statement clarifies that no official patches will be released for versions older than 8.2. This forces administrators of older systems to seek support from commercial vendors or other third-party providers. The reliance on external sources for critical security updates introduces additional complexity and potential delays in mitigation efforts.

What should you do?

Organizations should immediately audit their PHP versions to determine if they are running 8.2 or newer. If the software is up to date, applying the latest patches is critical. For those on older versions, contacting third-party vendors to inquire about available fixes or upgrade paths is the necessary next step.

What to do and how to stay safe: PHP

• Verify the current PHP version running on all servers and applications to identify exposure.
• Apply the latest security patches immediately if the system is running PHP 8.2 or newer.
• Contact third-party vendors or service providers to request backported fixes for legacy PHP versions.
• Monitor official PHP Foundation channels for any updates regarding the scope or severity of these vulnerabilities.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions receive the new security patches?

The PHP Foundation limits the release of patches for these remote code execution vulnerabilities to PHP 8.2 and newer versions.

What happens if I am running an older version of PHP?

Legacy deployments are not receiving official patches from the foundation and must depend on third-party vendors for security fixes.

How many websites are potentially affected by these flaws?

According to the report, the vulnerabilities could impact millions of websites that are still running vulnerable versions of PHP.