UPDATE

UPDATE
PSA for anyone running PHP, including Drupal, WordPress, or any PHP-based site:
PHP’s security team published an official advisory today fixing two separate critical remote code execution vulnerabilities, each independently exploitable:
One is a memory-handling bug (out-of-memory corruption)
One involves stale internal state surviving between requests on the same worker
PHP itself says the highest risk is on mod_php configurations, where a demonstrated exploit can trigger before any application code even runs, with no authentication required.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, available now at https://lnkd.in/giqPjs3h. In PHP’s own words: “There are no complete mitigations, updating is the only safe choice.”
If you’re on PHP 8.1 or earlier, there’s no official fix coming from the PHP project. Check your Linux distro or hosting vendor for a backported patch, or isolate that site until you can upgrade.
If you can’t patch in the next hour, there are partial mitigations (different settings for each of the two bugs, detailed in PHP’s advisory), but treat them as buying time, not as a fix. The only real answer here is the upgrade.
We’re patching across our own Drupal environments now and will keep watching for follow-up guidance as it develops.
#PHP #Drupal #WebSecurity #InfoSec