Critical PHP bugs trigger urgent patching across the web
Two severe PHP vulnerabilities, each rated 9.2, could let attackers run code remotely without authentication. The PHP Foundation issued emergency fixes and said all web-facing PHP installations should be updated immediately. Some European government sites went offline as a precaution, and the flaws may also affect products that embed PHP.
The PHP Foundation issued emergency updates on Wednesday for two 9.2-rated flaws that permit unauthenticated remote code execution. Installations handling web traffic are exposed, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed; mod_php carries the highest concern because exploitation can occur before application code runs. Some Dutch and Finnish government sites were taken offline as a precaution.
The bugs involve memory handling during out-of-memory conditions and reuse of request-owned global state by a later request on the same worker. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also appears in appliances, network devices and vendor products, and CERT-EU warned that backend use could affect commercial and open-source products.
The flaws could affect a broad slice of online life because PHP supports many websites and embedded systems. Organizations running public-facing sites, appliances, or vendor products may face service disruptions, emergency patching, and possible compromise. Users could encounter outages or data exposure if vulnerable systems are exploited. Administrators may need to inventory hidden PHP dependencies, not just corporate websites, and coordinate with vendors.