WORLDTECHPHP Ships Fixes for Four Branches After Code-Execution Flaws
The PHP project has shipped fixes for four of its supported branches. The flaws can let attackers run code on vulnerable web servers without logging in.
Fixes cover four supported branches
Fixes have now been shipped for four of the branches PHP still supports, so operators running those versions have patched code available to them.
The flaws allow an attacker to execute code on a vulnerable web server without first authenticating, which makes the patches a priority for anyone hosting affected installations.
Reporting on the flaws
The Defiant is the single named outlet reporting on the vulnerabilities and the patch release, and the account rests on its reporting alone.
Cloudflare, an information and communications technology company founded in 2009 and based in San Francisco, is connected to the reporting, but the verified facts do not describe its role in the matter.
Open questions
- How many servers were affected before the patches were released?
- Have any exploitation attempts been confirmed?