Computing

PHP discovers new remote code execution flaw but rules out emergency fix

PHP disclosed a narrowly applicable remote code execution flaw, advising administrators to disable session upload progress ...

Experts reveal another major PHP2Shell bug — and there's no emergency patch this time

The bug can trigger remote code execution but only under certain, "unlikely" conditions.
Morning Overview on MSN

PHP rushed out emergency patches for two critical flaws nicknamed PHP2Shell

The PHP project shipped emergency security releases on Oct. 21 to close two critical remote code execution holes, ...
Techaeris

PHP2Shell Fallout Continues as PHP Discloses a Third Flaw

PHP2Shell patches are two days old and the story is not closing. PHP disclosed a third flaw, attacks are climbing, and ...
InfoQ

PHP Patches Two Critical RCE Flaws That Were Already Under Attack

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code ...

PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical ...
The Next Web

PHP warns of a third PHP2Shell flaw but won’t rush out a fix

A third PHP2Shell flaw needs ‘a very unlikely combination’ of settings, the PHP Foundation says. Its fix waits for a routine ...

PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
Notebookcheck

PHP2Shell: Critical PHP flaws hit mod_php servers hardest

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated code execution, in some setups before any application code runs. Here is what goes wrong in the interpreter, ...