PHP has shipped fixes for two critical bugs that can let an attacker run code on a web server without logging in. The PHP project says everyone should update to the newest versions, namely 8.5.12, 8.4.27, 8.3.36 or 8.2.35, immediately.
Every PHP setup that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. On mod_php, the riskiest, a demonstrated exploit sets off the attack with a request from someone who isn’t logged in, before the site’s own code even runs.
Both bugs come down to how PHP cleans up after a request goes wrong. If a request runs out of memory mid-setup, the cleanup can treat half-built data as valid. If a fatal error hits at the wrong moment, leftover state can point at freed memory, which the next request on the same worker may use.
Linux distributions and long-term support vendors got the patches early, so check yours for updated packages. PHP 8.1 and older no longer get project updates, though the security team posted minimal fixes for 7.4, 8.0 and 8.1 for anyone building from source. Stopgaps like turning off session upload progress block some attack paths, but they “do not make an installation safe.”
A slow fix, then a fast leak
A developer contracted by the PHP Foundation spotted the first signs of the memory bug in 2024, while fixing an issue from an outside security audit, the foundation says. The fix then stalled for months, as every option came with a cost. “We won’t pretend otherwise: the delay was a structural failure,” it writes.
On August 11th, Ryan A at Calif, a security firm auditing PHP through the Patch the Planet program, reported that the same root cause could run code remotely, no conditions attached. OpenAI reported the same root cause independently that day.
The two bug IDs leaked on October 20th, so PHP moved the release up a day. Calif then posted a video of its exploit by mistake, and Chainguard, one of the distributors with early access, shipped patched builds more than six hours early. The foundation says none of the proof-of-concept exploits that surfaced after the leak worked at release time, but the deleted video helped speed up work on them.
If you look after a PHP server (Yes, we’re talking to you, HYPRcurrent web dev.), we’d put this update ahead of lunch.
