PHP Foundation ships security updates for 8.2 through 8.5 series

The PHP Foundation distributed security updates for four major version lines on the same day. The releases include PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. These specific builds resolve two critical vulnerabilities that were identified within the codebase. The foundation noted that it had to move the release date forward by one day. This acceleration occurred because the Common Vulnerabilities and Exposures identifiers for these flaws started circulating on the internet before the planned publication time.

Which PHP versions require immediate updates?

Security teams must verify the PHP versions running on their servers. The foundation released patches for the 8.5, 8.4, 8.3, and 8.2 series. Specifically, administrators should update to at least PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, or PHP 8.2.35. These are the minimum versions that contain the fixes for the two critical issues. Systems running older patch levels within these major versions remain exposed to the identified flaws until they are upgraded to the newly released builds.

Why did the release happen early?

The PHP Foundation stated that it released the patches a day earlier than originally scheduled. The trigger for this change was the appearance of the CVE IDs on the internet. When these unique identifiers for vulnerabilities become publicly visible, it often signals that details about the flaw are leaking or being discussed openly. By releasing the fixes immediately, the foundation aims to reduce the window where attackers might exploit the known identifiers without a corresponding public patch being available for users to apply.

What is the severity of these flaws?

The foundation classified both vulnerabilities as critical. This rating indicates that the issues pose a significant risk to systems running the affected software. The classification mandates that users prioritize updating their environments to the latest patched versions to mitigate the risk associated with these two distinct issues. The source material does not provide further technical details on the specific impact or exploitability of these flaws beyond their critical severity rating.

Detection notes

Teams usually monitor web server access logs for unusual request patterns that deviate from standard application traffic. Look for unexpected command execution attempts or suspicious file uploads that do not match legitimate user behavior. Check system process lists for new or unexpected processes spawned by the web server user account. Review authentication logs for privilege escalation events or access from unexpected source IP addresses. If anomalous activity is detected, isolate the affected server from the network immediately to prevent lateral movement while investigating the root cause and preparing for remediation.

Background: Lateral movement

Stop lateral movement by enforcing least privilege, segmenting networks, and monitoring internal traffic. This checklist provides specific controls to limit an attacker’s ability to move between systems after gaining initial access.

Read the full guide: Lateral Movement Prevention Checklist for Network Security

What to do and how to stay safe: PHP Foundation

• Inventory all servers and containers running PHP versions 8.2, 8.3, 8.4, or 8.5 to identify those below the patched versions.
• Apply the specific updates provided by the PHP Foundation to upgrade to the minimum secure versions listed in the release notes.
• Monitor server logs and network traffic for signs of exploitation attempts targeting the known vulnerability vectors.
• Verify that automated backup and rollback procedures are functional before applying updates to production environments.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific PHP versions fix the critical vulnerabilities?

The vulnerabilities are fixed in PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35.

Did the PHP Foundation release emergency patches?

The foundation released patches for the vulnerabilities; the source material refers to them simply as patches, not emergency patches.

Why was the patch release date moved up by one day?

The release was accelerated because the CVE IDs for the flaws began circulating online before the scheduled release time.