🔒PHP 8.5.12 Fixes Critical Security Flaws
PHP just patched two critical security holes
TL;DR
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out, addressing critical vulnerabilities. These updates fix issues allowing unauthenticated attackers to execute code, impacting nearly every PHP request. Developers should update ASAP.
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are out, addressing critical vulnerabilities that allow unauthenticated attackers to execute code on PHP servers. These flaws affect memory management and error handling, components hit by nearly every request. Developers should update immediately to avoid potential exploits. The PHP Foundation funded a security audit by Quarkslab in 2024 and added AI tools like Anthropic's Claude Mythos and OpenAI's Daybreak Red to validate reports and exploits. The team has published 15 CVEs since July 1st and worked through over 100 invalid reports.
Key Points
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address critical vulnerabilities, released on October 21st, 14:00 UTC.
The security flaws allow unauthenticated attackers to execute code on PHP servers, impacting memory management and error handling.
The PHP Foundation funded a security audit by Quarkslab in 2024, adding AI tools like Anthropic's Claude Mythos and OpenAI's Daybreak Red.
Since July 1st, the PHP security team has published 15 CVEs and worked through over 100 invalid reports.
The vulnerabilities were disclosed on October 21st, 14:00 UTC, with the release brought forward to the same day.
Why It Matters
If you're running PHP in production, this update is crucial. The vulnerabilities allow unauthenticated attackers to execute code, impacting nearly every request. The PHP security team has been working hard to address these issues, but the risk remains until you update. Developers should prioritize this update to avoid potential exploits.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.