Our takePHP's foundation runs on one full-time employee and faces growing workload from AI-generated code; unsurprising that two critical unauthenticated RCEs slipped through. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, starting with anything internet-facing.Security Resilience desk
Sources (2)
- the420_in · the420_in
- securityweek · securityweek
What this means for you — Security leader:Review all PHP runtimes you maintain or that sit behind your applications; patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 immediately, starting with internet-facing systems.
What this means for you — Lean IT orgs:If your website or internal tools run on PHP, update it today to the latest versions (8.2.35 or higher). Most shared hosting providers will push the update automatically; check your host dashboard or contact them to confirm.
What this means for you — MSP:Audit every client PHP stack (self-hosted or in hosting environments) and ensure the runtime is updated to at least 8.2.35/8.3.36/8.4.27/8.5.12. Prioritize internet-exposed instances first.
What this means for you — Researcher:The PHP Foundation story highlights chronic underfunding of core open-source maintenance; the two critical RCEs are the direct result.