PHP Sets Emergency Fix for Two Critical Flaws

PHP’s security team has given administrators a deadline and little else to go on. Fixes for two critical vulnerabilities in the language, each rated 9.2 on version 4.0 of the CVSS severity scale, are scheduled for 14:00 UTC (15:00 BST) on Wednesday 21 October, the team announced on its mailing list on Tuesday evening.

PHP has not said which versions are affected, what the flaws allow or which releases will carry the fixes; its news archive entry says full details, affected versions and fixed versions “will be published with the release”. What it has said is that the date could move forward: “We reserve the right to release earlier if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.”

A reported leak put the clock on the patch

PHP powers many websites and web applications, including content management systems and e-commerce platforms, as BleepingComputer notes, so a flaw in the language sits underneath the software built on it. The security team is asking users to act before it has said what to fix. “We encourage all PHP users to prepare now so you can update as soon as it is available,” wrote Jakub Zelenka of the PHP security team.

Security firm watchTowr told BleepingComputer that information about the flaws had leaked before a planned embargo date. “In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,” chief executive Benjamin Harris said. watchTowr added that it had not seen the flaws exploited in the wild. PHP’s own announcement says nothing about a leak.

Preparing means knowing where PHP runs

Until the release lands, preparation is an inventory job. The EU’s cybersecurity service for its institutions, CERT-EU, advises organisations “to prepare for immediate patching of affected assets”, and says that where patching cannot be done straight away they should consider isolating internet-facing applications from public networks until a fix is available.

That means knowing which servers, containers and hosted sites run PHP, who maintains them and how quickly each can take an update, including those that depend on a hosting provider or a Linux distribution to ship the new builds. Teams that rely on packaged PHP will want to watch their distribution’s security feeds as well as php.net.

The next marker is fixed unless events overtake it: 15:00 BST today, when PHP says it will name the affected versions and publish the fixes. If details surface or attacks begin before then, the release could come sooner.