PHP issues urgent patches for two critical unauthenticated remote code execution flaws

Two critical vulnerabilities in the PHP scripting language allow unauthenticated remote code execution, prompting an urgent update from the project maintainers. According to Techmeme, these flaws affect all web-serving deployments that rely on PHP, exposing a vast number of internet-facing applications to potential compromise. The severity is rated as critical due to the lack of authentication requirements for exploitation.

What versions are impacted by these vulnerabilities?

The PHP project has released specific patched versions to address these critical flaws. Users running PHP 8.5 must update to version 8.5.12. Those on PHP 8.4 should move to version 8.4.27. For PHP 8.3 users, the required update is version 8.3.36. Finally, systems running PHP 8.2 must be updated to version 8.2.35 to eliminate the risk.

Why are these vulnerabilities considered critical?

These two vulnerabilities are classified as critical because they enable remote code execution without requiring authentication. An attacker can exploit these flaws to run arbitrary code on the server from a remote location. This level of access typically allows full control over the compromised system, making immediate remediation essential for all organizations hosting PHP-based web applications.

Which environments need immediate attention?

According to the report by Techmeme, all web-serving deployments using PHP are affected by these vulnerabilities. This broad impact means that any organization running websites, web applications, or backend services powered by PHP must prioritize updating their PHP installations. The widespread use of PHP in web development makes this a high-priority incident for security teams globally.

What is the recommended response for security teams?

Security teams should immediately verify their current PHP versions against the patched list provided by the project. If any systems are running vulnerable versions, they must be updated to the latest secure releases as soon as possible. Given the unauthenticated nature of the exploits, delaying updates increases the risk of successful attacks. Continuous monitoring for unusual activity is also advised during the patching process.

Detection notes

Security operations teams should monitor web server logs for unusual request patterns or unexpected command execution attempts. Look for signs of unauthorized access or strange outbound connections from web servers. Check for new files or modifications in web directories that could indicate successful exploitation. Implement network segmentation to limit lateral movement if a breach occurs. Regularly review access logs for anomalies that deviate from normal user behavior.

Background: Lateral movement

Stop lateral movement by enforcing least privilege, segmenting networks, and monitoring internal traffic. This checklist provides specific controls to limit an attacker’s ability to move between systems after gaining initial access.

Read the full guide: Lateral Movement Prevention Checklist for Network Security

What to do and how to stay safe: PHP

• Verify the current PHP version running on all web servers and compare it against the patched versions.
• Update PHP installations to the latest secure versions immediately to mitigate the risk of exploitation.
• Monitor server logs for any signs of unauthorized access or suspicious activity following the update.
• Ensure that all web applications are tested for compatibility with the new PHP versions after updating.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions contain the fixes for these vulnerabilities?

The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Do these vulnerabilities require authentication to exploit?

No, these are unauthenticated vulnerabilities, meaning attackers can exploit them without credentials.

Are all PHP deployments affected by these critical flaws?

Yes, according to Techmeme, all web-serving deployments using PHP are affected.