PHP schedules critical security release for two vulnerabilities on October 21st
The PHP security team rates both flaws CVSS v4.0 9.2 and plans to publish affected and fixed versions with the release.
By Ryan Merket · Published · Updated
Primary source: X
Why it matters
The post alleges two remote-code-execution vulnerabilities, but the available evidence does not confirm the flaws or establish affected versions, exploitation or fixes. Treating an unverified warning as a confirmed advisory could misdirect security response.
Update, October 20th: RuntimeWire first reported the emerging PHP vulnerability story before PHP's security team confirmed two critical flaws and scheduled a security release for Wednesday, October 21st, at 14:00 UTC. PHP says it will publish full details, affected versions and fixed versions with the release. The team says it may release earlier if details become public or evidence of active exploitation appears. It encourages PHP users to prepare to upgrade as soon as the release is available.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.