PSA: PHP patches two critical flaws, server admins urged to update

What happened

PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all websites, the potential impact is enormous.

Apache deployments are particularly vulnerable, and security agencies are urging immediate updates. PHP is an open source general-purpose server-side scripting language originally designed for Web development to produce dynamic Web pages.

It is one of the first developed server-side scripting languages to be embedded into an HTML source document rather than calling an external file to process data. The code is interpreted by a Web server with a PHP processor module which generates the resulting Web page.

It also has evolved to include a command-line interface capability and can be used in standalone graphical applications. If you are new to PHP and want to get some idea of how it works, try the introductory tutorial .

PHP 8.5.12 fix two critical vulnerabilities that can allow unauthenticated remote code execution (running programs on a machine from somewhere else). All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.