On October 20, the PHP security team announced that security patches addressing two critical vulnerabilities will be released on October 21 at 11 PM JST. Both vulnerabilities are rated '9.2 (Critical)' on CVSS v4.0, and users are urged to prepare for immediate updates upon release.
The updates are expected to target the four currently officially supported PHP branches: 8.2, 8.3, 8.4, and 8.5. Versions prior to PHP 8.1 have reached end-of-life for official support, and as such, these security updates will not be provided for them.
Security researchers have also pointed out that a wide range of versions, potentially from PHP 5 onwards, could be affected. Users running older PHP versions should consider migrating to a newer version.
There are warnings that once the patches are released, attackers will gain clues, making the update process a race against time. Website administrators should verify their PHP versions and update procedures, and be prepared to cross-reference the affected versions with the patches upon release to implement the fixes.
Made with AI
