The PHP project moved four security updates forward after vulnerability identifiers leaked, fixing two flaws rated 9.2 out of 10 that could let unauthenticated attackers run code on web servers.
The project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday, Oct. 21. Its advisory says applying the new versions is necessary to fully address the vulnerabilities. Both received a 9.2 rating under version 4.0 of the Common Vulnerability Scoring System (CVSS).
The PHP Foundation said the identifiers began circulating around 11 a.m. ET (15:00 UTC) on Oct. 20 with an incorrect release time and a reported severity score of 10.0. It moved the release date up one day, from Oct. 22 to Oct. 21. The Foundation said proof-of-concept material also circulated, but its team had not found a working exploit by the time the updates were released.
The vulnerabilities affect PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project identifies mod_php as the highest-risk setup because an unauthenticated request can reach the vulnerable code before application processing begins. One flaw disrupts the setup of PHP’s internal request data during an out-of-memory event, which can leave cleanup with invalid values. The other can leave a worker referring to memory released after an earlier request.
The Foundation said a core developer it contracted first encountered signs of the out-of-memory issue while fixing a separate problem noted in a 2024 external audit conducted by Quarkslab. Work on a fix stalled and resumed over several months as developers weighed compatibility, speed and effects on extensions. The Foundation also cited consensus-based decisions and a shortage of experienced specialists, calling the delay “a structural failure.”
The Foundation says the PHP security team has issued 15 CVE notices since July 1 and screened more than 100 reports that repeated existing reports, could not be reproduced or proved invalid. The security team is moving toward majority voting; the Foundation says its leadership will become involved sooner in complex cases. It is seeking funding from companies, hosting providers, cloud platforms, distributions, governments and public institutions that depend on PHP.
The European Union Agency for Cybersecurity (ENISA) and partner agencies urged organizations to identify PHP-based applications and prioritize updates on internet-facing systems. PHP 8.1 and earlier no longer receive regular upstream security updates, although some distributions and long-term support providers offer backported fixes. The PHP security team also prepared minimal source backports for versions 7.4, 8.0 and 8.1. The PHP 8.6 timetable lists release candidate 5 for Nov. 5.
