Today's PHP Security Release, and How We're Strengthening PHP Security

The PHP Foundation released a security update today that covers the entire PHP 8.x branch, fixing two vulnerabilities that allow remote code execution. The flaws began circulating on forums and social media on October 20, accompanied by incorrect information about the release date and an inflated CVSS score. In response, the project accelerated its official announcement and pushed the patched version out the same day, moving the planned release date forward.

The disclosure process was compromised when a security firm involved in the investigation accidentally shared a video showing a working exploit and revealing additional details. Copies of the material spread quickly, prompting third parties to develop proof‑of‑concepts and increasing the exposure of vulnerable systems.

According to the team that discovered the issue, the investigation started in August, with unauthenticated execution tests against platforms such as Drupal and WordPress, and the formal notification to the PHP security team was made at the end of August. The patch became available on October 21, coinciding with the public disclosure.

This news matters because millions of websites rely on PHP; rapid patch adoption is essential to prevent breaches that could compromise confidential data and disrupt online services. The incident also highlights the need for careful handling of information during responsible disclosure.

Read the original article on Simon Willison

This summary is an informational synthesis produced by dataqbs.com. All rights to the original content belong to its author and the cited media outlet. We act solely as curators of technology news and claim no authorship.