Technology
Critical PHP flaws enable unauthenticated remote code execution across supported releases
PHP released security updates fixing two critical vulnerabilities that can enable unauthenticated remote code execution in web-serving installations. The flaws affect PHP-FPM, mod_php, php-cgi and other deployments, with the highest demonstrated risk in mod_php. The issues involve corrupted state after out-of-memory failures and stale request data reused by later requests. Updating is the complete fix; older PHP versions require vendor-specific support or migration, while configuration changes only reduce particular attack paths.
Editorial summary · Publisher article
What matters
- Affected releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with vendor packages requiring separate checks.
- The demonstrated vulnerabilities can be triggered before application code runs, making the exposure independent of the application framework.
- Temporary controls include request-size limits, disabling certain upload-progress paths and worker restarts, but they do not make systems safe.
Why the issue is unusually broad
The vulnerable paths are in PHP’s request-processing engine, so websites can be exposed even when their own application code is secure. The advisory identifies two distinct failure patterns involving partially initialized or stale internal state.
Context & caveats
- The source says PHP 8.1 and older no longer receive project updates; available backports depend on the distribution or vendor.
Why this made the edition
The official PHP advisory provides detailed technical causes, affected versions, confirmed attack paths, patch versions, exposure conditions and interim risk-reduction measures.
Source material