The PHP security team released emergency fixes Wednesday for critical flaws allowing unauthenticated remote code execution, requiring immediate patching for global websites, including those powered by WordPress.
The vulnerabilities pose a significant risk to all PHP installations serving web requests and necessitate urgent updates to prevent potential compromises, cybersecurity experts said.
Patches were issued for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with developers emphasizing that updating is the only secure option as no complete workaround exists to mitigate the risks. Older, end-of-life PHP versions, including 7.4, 8.0, and 8.1, received limited source-code fixes for self-builders and vendors, the PHP team reported.
Apache servers utilizing mod_php face the highest risk from these vulnerabilities, Sansec, a cybersecurity firm, stated. Governments and universities in the Netherlands and Finland proactively took their websites offline as a precaution ahead of the patch release.
Website owners can verify their PHP version through WordPress Site Health tools or by contacting their hosting providers to ensure the fixes are installed. Upgrading older, unsupported PHP versions is also advised.
A Web Application Firewall (WAF) does not replace the need for direct patch installation, according to CERT-EU. Websites temporarily taken offline for patching should display an HTTP 503 maintenance page to inform users.
Following the application of patches, website administrators should conduct thorough checks for signs of compromise, such as unfamiliar administrator accounts, web shells, or unexpected changes to PHP files, as the patches do not remove existing intrusions, the UK National Cyber Security Centre advised.
The International Cyber Digest reported that the increasing sophistication of AI-powered attack tools is expected to accelerate the development of future vulnerabilities, potentially reducing the response time available for website owners to address new threats.
Source: Search Engine Journal
