PHP Releases Emergency Patches for Critical RCE Vulnerabilities

Summary: PHP has released emergency updates to fix two critical vulnerabilities within the language itself. These flaws allow an attacker to execute code on a web server without requiring an account.

This news announces two critical remote code execution (RCE) vulnerabilities discovered in the PHP language itself, requiring emergency patches. Such vulnerabilities, being at the language level that forms the foundation of web applications, have a very broad impact. It is noted that exploit attempts have already begun.

Although the full technical details of the vulnerabilities are not disclosed, the naming “PHP2Shell” suggests they likely stem from a flaw in PHP’s interpretation or request processing mechanisms. Such RCE vulnerabilities typically arise from issues like insufficient input validation, deserialization errors, or memory corruption. An attacker could execute arbitrary commands on the server with a specially crafted HTTP request.

All web servers and applications using PHP in live systems are directly at risk. Since these vulnerabilities offer the ability to execute code without authentication, they provide a very easy path for attackers to compromise systems. It is critical for infrastructure teams to immediately update their PHP versions and accelerate patching processes.

Web Application Firewalls (WAFs) and Intrusion Detection/Prevention Systems (IDS/IPS) can partially mitigate such attacks, but the most definitive solution is to upgrade to current PHP versions. Furthermore, it must be ensured that environments where PHP applications run are configured with the principle of least privilege.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar