PHP Foundation releases emergency patches for two critical vulnerabilities in major versions

The PHP Foundation released security updates for four major PHP versions earlier today to fix two critical vulnerabilities. The organization issued PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the flaws. These releases were necessary because the CVE identifiers associated with the vulnerabilities had already begun circulating online, prompting an early release schedule.

According to Techmeme, the PHP Foundation detailed how it found and fixed the two flaws in its announcement. The project team stated that it had to release the patches a day early due to the premature circulation of the CVE IDs. The foundation emphasized the importance of the early release in response to the now-public vulnerability references. The summary noted that the releases fix two critical vulnerabilities that were addressed in the new versions.

Context and Background

The PHP Foundation provided specific details regarding the discovery and remediation of the two critical vulnerabilities. The organization explained the process it used to identify the security issues within the software code. Fixing these flaws required careful coordination to ensure stability across the multiple supported versions. The decision to move the release date forward was a direct response to the information leakage regarding the CVE IDs.

Techmeme reported that the PHP project released the updates earlier today to address the circulating identifiers. The summary noted that the releases fix two critical vulnerabilities. By making the patches available immediately, the foundation responded to the public availability of the CVE details. This action aligns with the foundation's statement that it had to release patches a day early after the CVE IDs began circulating online.

Who Is Affected

Users running PHP 8.2, 8.3, 8.4, or 8.5 are affected by these critical vulnerabilities. The specific versions requiring immediate updates are PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, and PHP 8.5.12. Organizations relying on older versions of these branches should apply the latest security releases to protect their systems. The PHP Foundation targeted these specific version lines to ensure broad coverage for current users.

According to the source material, the PHP project released these specific version numbers to address the security gaps. Any system operating on a version prior to these releases remains vulnerable to the two critical flaws. Administrators must verify their current PHP version to determine if they are exposed. The foundation’s announcement serves as a direct call to action for maintainers of PHP-based applications to update their environments promptly.

What should you do?

System administrators should immediately check their PHP versions against the released patch numbers. If a system is running an older version of PHP 8.2, 8.3, 8.4, or 8.5, it should be updated to the latest release. Monitoring for any further announcements from the PHP Foundation is recommended as details about the vulnerabilities may be expanded. Ensuring that all servers are patched reduces the risk associated with the circulating CVE IDs.

What to do and how to stay safe: PHP

• Verify the current PHP version installed on all servers and compare it to the patched versions listed by the foundation.
• Apply the latest security updates for PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as soon as possible to mitigate the critical vulnerabilities.
• Monitor official PHP Foundation channels for additional details regarding the nature of the two flaws and any further security advisories.
• Review server logs for any unusual activity that might indicate attempts to exploit the vulnerabilities before the patches were applied.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions contain the fixes for the two critical vulnerabilities?

The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, according to the PHP Foundation's release announcement.

Why were the PHP security patches released a day early?

The PHP Foundation released the patches early because the CVE IDs for the two critical vulnerabilities began circulating online prematurely.

How many vulnerabilities were addressed in these recent PHP releases?

The recent releases addressed two critical vulnerabilities that were found and fixed by the PHP Foundation, as reported by Techmeme.