PHP releases urgent fixes for two critical security flaws
In brief
- Two critical remote code execution vulnerabilities fixed in PHP 8.x.
- Exploits have been circulating since yesterday due to a disclosure leak.
- PHP Project advanced the patch release date to October 21st.
The PHP project released today patches for two remote code execution vulnerabilities affecting all 8.x versions. According to the official announcement, exploits have been circulating since the day before due to a leak in the coordinated disclosure process. The affected CVE IDs were shared online with an incorrect CVSS score of 10.0 (revised to 9.2) and an early release date.
The PHP Project expedited the release of patches, originally scheduled for October 22nd, to October 21st at 14:00 UTC. A security firm accidentally published a demonstration video, accelerating the creation and spread of exploitation proof of concepts as early as October 21st.
This summary gives you the essentials. The full article, its figures and quotes are on Simon Willison's Weblog.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error