Critical PHP RCE Flaws Prompt Emergency Out-of-Cycle Release
Two unpatched PHP vulnerabilities rated CVSS 9.2 could allow remote code execution. An emergency security update is scheduled for October 21.
TL;DR
- PHP will release emergency fixes on October 21 for two critical RCE flaws.
- Vulnerabilities scored 9.2 on CVSS v4.0, indicating severe risk.
- Exploitation could lead to full remote code execution on affected servers.
- Organizations should prepare to patch immediately upon release.
- No technical details disclosed yet; official advisory expected with update.
The PHP project has announced an unscheduled security release to address two critical vulnerabilities that could allow remote code execution. Rated at 9.2 on the CVSS v4.0 scale, these flaws pose a significant threat to web applications relying on PHP. The update is set to drop at 14:00 UTC on October 21.
Details about the nature of the flaws remain under embargo until the official release. However, given their severity score and classification as remote code execution issues, organizations using PHP are advised to prepare for an urgent patching process. These types of vulnerabilities can enable attackers to fully compromise vulnerable systems without requiring user interaction.
What We Know So Far
- Two critical PHP vulnerabilities have been assigned a CVSS score of 9.2.
- The flaws enable remote code execution (RCE), making them highly dangerous.
- An out-of-cycle security patch will be released on October 21 at 14:00 UTC.
- No specifics about exploitation vectors or affected versions have been disclosed yet.
- The PHP team typically refrains from detailed vulnerability descriptions pre-release.
Recommended Actions
- Plan for immediate deployment of the upcoming PHP security updates.
- Audit environments running PHP to identify potentially exposed services.
- Monitor official PHP channels for confirmation of patched versions post-release.
- Consider temporary mitigation strategies if high-risk exposure exists pre-patch.
- Subscribe to advisories from trusted sources like The Hacker News for real-time updates.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.