PHP releases security updates after vulnerabilities put websites at risk

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.[1] The PHP Foundation said vulnerabilities could let an unauthenticated attacker execute code on servers running PHP.[1] It also said errors can leave data behind that a malicious actor may access, including private information, or use to run malicious code.[2] Remote code execution was confirmed on PHP-FPM through application-level code paths, the Foundation said.[1] The Foundation urged PHP users to update immediately.[1]

New Scientist reported that about 70 per cent of websites worldwide were vulnerable to data theft and defacement because of the flaw.[2] It said PHP is commonly used to power websites and services including WordPress, Facebook and Wikipedia.[2] The vulnerability affects websites rather than individuals’ personal computers.[2] Every PHP version released in the decade before the report was affected by at least one of the vulnerabilities.[2] For teams assessing exposure, the reported scope makes it important to check the PHP versions used on their web servers rather than treating this as a desktop-computer update.[2]

The PHP Foundation said the vulnerabilities affected central PHP functions, making them difficult to fix without potential compatibility or performance costs.[1] A PHP core developer found the first signs of the out-of-memory problem while fixing an issue reported by Quarkslab.[1] The Foundation said a potential exploit had been theorized in 2024, but researchers had not found concrete attack vectors at that point.[1] It attributed the delay in fixing the issue to a flawed decision process and insufficient resources.[1] These details indicate why updating is the immediate action available to PHP users, even as the underlying fixes carry trade-offs.[1]

Cloudflare counted thousands of exploits in the hours before the announcement, after an apparent leak of vulnerability information, RNZ reported.[3] Separately, the PHP Foundation said its security team had not identified functional exploits at the time of release or public disclosure.[1] Alan Woodward of the University of Surrey said exploitation requires millisecond timing, but many attempts could be run until one finds the right answer.[2] New Scientist reported that government websites in France, Denmark, Finland and the Netherlands were taken offline as a precaution.[2] Woodward said smaller websites with fewer resources could remain vulnerable for months or years.[2]