PHP Releases Critical Patches for Remote Code Execution Flaws

The PHP Security Team released patches on October 21 for two critical vulnerabilities rated 9.2 on the CVSS v4.0 severity scale. These flaws potentially allow unauthenticated remote code execution, which could result in full system compromise, data theft, or website defacement. Because PHP powers major platforms including WordPress, Drupal, and Joomla, the European Union Computer Emergency Response Team warned that organizations unable to apply the fixes immediately should consider taking affected websites offline.

While the Australian Cyber Security Centre reported no known active exploitation, Cloudflare has already begun updating firewall rules to mitigate emerging attacks. Dane Knecht, chief technology officer at Cloudflare, stated that these firewall mitigations are a stopgap only and urged users to patch as soon as the update is available.

The PHP Security Team scheduled the release for 1400 GMT on Wednesday and urged all users to upgrade immediately to secure their systems.