Our takePHP has pushed emergency patches for two critical unauthenticated RCE flaws (PHP2Shell) in the runtime itself. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately.Security Resilience desk
Sources (8)
- hackernews · hackernews
- nvd_recent · nvd_recent
- hackread · hackread
- cccs · cccs
- bleeping · bleeping
- infosec_mag · infosec_mag
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
What this means for you — Security leader:Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately; these runtime flaws allow unauthenticated RCE on any unpatched server regardless of application code.
What this means for you — Lean IT orgs:Update your PHP version right now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use shared hosting, ask your provider today whether they have applied the emergency patches.
What this means for you — MSP:Audit all client PHP instances and push updates to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; these runtime RCEs expose every unpatched web server.
What this means for you — Researcher:Study the PHP2Shell patches in 8.5.12/8.4.27/8.3.36/8.2.35; exploit attempts are already live.