PHP: update the systems you might overlook

What is confirmed

PHP has fixed two flaws that may allow unauthenticated code execution. CERT-SE reports that both are in CISA's catalogue of known exploited vulnerabilities. PHP lists fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [1, 2]

Who is affected?

PHP-based web services and products containing PHP. Distributions may backport a fix without adopting the PHP project's version number. Check the vendor's security advisory for your particular product. [1]

Our recommended workflow

If an update is delayed, CERT-SE recommends isolating affected internet-facing PHP applications. [2]

1. List public web services and ask the operations or hosting provider which ones use PHP.
2. Secure the configuration and recovery path. Install using the product's supported update mechanism.
3. Reload affected processes as instructed by the vendor and test important functions.
4. Review logs for suspicious activity. A patch does not prove that no earlier compromise occurred.

Additional guidance

PHP has added guidance on session.upload_progress.enabled for an unusual combination of serialisation settings. Read the current instructions before changing anything. Separate -1 packages for Windows also update Brotli without changing the PHP runtime version. [1]

If you use a hosting provider

Ask the provider to confirm that both your website's and the platform's PHP components are fixed. Keep the date and response. You normally do not need to change server settings yourself.

Apply and verify the fix

Practical recommendation: do not change PHP settings at random to compensate for a missing patch. If a packaged product contains PHP, use its supported update path.

1. Confirm which PHP version the web server or application actually runs. A command-line version check may refer to another installation.
2. Install the product vendor's corrected packages and carry out the required reload or restart.
3. Check the running service's package or version information afterwards. Use the vendor's advisory if the fix was backported.
4. Test sign-in, uploads and other important functions. Record the package version, test results and date.

Need a common workflow?

The guide “A vulnerability has been found – take it through to a verified fix” explains how to check whether you are affected, prepare recovery and verify the result.