PHP Warns of Two Critical Vulnerabilities, Emergency Patches Due Today at 14:00 UTC

The PHP security team has announced fixes for two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The release is scheduled for October 21 at 14:00 UTC (4:00 p.m. Polish time). The advisory went out on October 20, so administrators can prepare to update before the details are made public.

What has been confirmed

The official PHP announcement confirms how many vulnerabilities there are, how severe they are and when the release is planned. The full description, the list of affected versions and the version numbers that contain the fixes will come out with the update. BleepingComputer has also reported the announcement independently.

The PHP maintainers say they may publish earlier if details of either vulnerability leak or if there is evidence that one is being exploited. That caveat alone does not confirm that any attacks are underway. The announcement also gives no basis for assuming that every PHP installation is vulnerable, or that any particular configuration change removes the risk.

Who should prepare

Any organization that runs websites, online stores or web applications on PHP should review its environment. Self-managed servers, containers and managed hosting each need a different update path. If a provider maintains the service, make sure you know who is responsible for updating the runtime and testing the application afterward.

The steps below are our editorial recommendations for getting ready. The final scope of the update should follow the advisory that ships with the release.

What to do now

• Build an inventory of your PHP installations, their versions, their owners and the applications they support.
• Confirm that backups are available and that you can restore service if an update fails.
• Agree with your administrator or hosting provider on who will be on call when the patches are released.
• Watch the official PHP announcements, because the release time may change.
• After the release, check the list of affected versions against your inventory, deploy the right packages and test your applications.

SecurHUB’s take

Advance notice gives organizations time to decide who owns the update and to get testing ready. A security audit can help you map your applications and the dependencies that determine how quickly you can roll out urgent patches.

Sources: PHP, BleepingComputer