Critical PHP flaws continue to pressure administrators
Security services warn organisations to update vulnerable web servers as soon as possible.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Two critical vulnerabilities in PHP continue to attract worldwide attention because attackers can execute code on vulnerable servers without login credentials. European and commercial security services advise organisations to patch immediately or temporarily shield internet-facing systems.
The vulnerabilities lie in the PHP runtime, the software that executes the logic of websites and web applications on many web servers. According to the official PHP announcement, the PHP developers released fixes on 21 October for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
According to CERT-EU, the flaws can lead to remote code execution: an attacker can remotely cause commands to be executed on a server. One flaw concerns memory management when a process reaches its memory limit. The other can, following an error, make old internal data available again to a subsequent request.
The European cyber security service writes that technical information and proof-of-concept code are now circulating publicly. According to CERT-EU, this increases the likelihood that attackers will try to exploit the flaws. CERT-EU considers installations using Apache and mod_php particularly risky, but other ways in which PHP processes web requests are also affected.
AWS reported on 23 October that its own services had not been affected by the vulnerabilities. According to AWS, customers who use vulnerable PHP versions within their own infrastructure must nevertheless check whether they could be affected. Bitdefender wrote a day earlier that it had not observed active exploitation, but likewise advised patching immediately.
For older PHP versions, administrators must establish whether an official solution is available. They should therefore check whether their Linux distribution or supplier offers a backported security update. Temporarily restricting functionality may reduce exposure, but according to CERT-EU only an updated version resolves the problem completely.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical core, affected versions and patching advice have been confirmed by the PHP organisation and CERT-EU. The text distinguishes between vulnerability, possible exploitation and attacks that have actually been established.
- confirmed The PHP developers released fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. — Mentioned in the official PHP announcement and the CERT-EU advisory. source
- confirmed The vulnerabilities can lead to code execution without login credentials. — CERT-EU describes unauthenticated remote code execution. source
- confirmed AWS reported that its own services had not been affected. — Stated in AWS's security bulletin of 23 October. source
- confirmed Bitdefender had not observed exploitation. — Included in Bitdefender's technical advisory. source
Editor's note
The vulnerabilities and patches have been confirmed by PHP and CERT-EU. AWS reported that its own services were not affected; the risks apply mainly to organisations running vulnerable PHP versions themselves. No independent evidence was found that a specific Dutch company had been attacked.Sources
More on this in Dutch media
- Het Parool — „php cybersecurity”
- NRC — „php cybersecurity”
- Tweakers — „php cybersecurity”