PHP Security Team to Release Critical Updates for Two Vulnerabilities

black floor lamp on living room sofa — Toa Heftiba / Unsplash

The PHP Security Team announced on October 20 that they will release a security version addressing two critical vulnerabilities on October 21 at 11 PM (Japan time). Both vulnerabilities have been rated with a severity score of 9.2 (critical) according to CVSS v4.0, prompting the team to urge users to be prepared to update immediately after the release.

The updates are expected to cover four currently supported PHP versions: 8.2, 8.3, 8.4, and 8.5. Versions prior to PHP 8.1 have reached the end of official support, and no security updates are anticipated for those older versions.

Security researchers have indicated that a wide range of versions from PHP 5 onwards may be affected, suggesting that users running older versions of PHP should consider transitioning to the latest versions.

Following the release of the fixes, there are concerns that attackers may gain insights into the vulnerabilities, making timely updates critical. Site administrators are advised to verify their PHP versions and update procedures, ensuring they can match the released updates to the affected versions swiftly after publication.