PHP Issues Emergency Security Release for Two Critical Remote Code Execution Flaws

PHP will release an emergency security update at 14:00 UTC on October 21 to fix two critical vulnerabilities. PHP's security team has rated them 9.2 on the CVSS v4.0 scale but has not yet described them. Researchers at watchTowr say the flaws allow remote code execution, which means an attacker could run their own commands on an affected server. No exploitation has been reported so far.

The early release followed a leak. On October 20, an online post claimed two serious PHP flaws would be disclosed on October 22, rated CVSS 10.0 and affecting versions from PHP 5 onward. watchTowr then said the leaked information was real and that the flaws were under embargo. The leak revealed the flaws' existence, a score, a date and two CVE identifiers, but not how they work. The CVSS 10.0 score and the claim that every version since PHP 5 is affected are unconfirmed. PHP's own notice names no CVE identifiers and says full details and fixed versions will be published with the release.

Only PHP's four supported branches, 8.2 through 8.5, will receive fixes. Versions 8.2 and 8.3 get security fixes only, while 8.4 and 8.5 are in active support. Anything older, including 8.1, 8.0, 7.x and 5.x, is end of life. If the flaws reach those branches, those installations will have no vendor patch.