Critical vulnerabilities in PHP: Install security updates immediately
Two critical vulnerabilities in PHP could allow attackers to execute malicious code on affected servers without logging in. Security updates are now available. The National Cyber Security Centre (NCSC) recommends updating affected systems without delay. In addition to web servers, please also check applications and devices that use PHP as an integrated component.
Also check embedded and internal PHP installations
The assessment must not be limited to publicly accessible websites. PHP may also form part of administration interfaces, internal specialist applications, hosting platforms, containers or appliances. In such cases, operators are not always aware that the product uses PHP in the background.
Check with your software suppliers and service providers to determine which products are affected and which updates are required. Prioritise systems that are accessible from the internet and applications with access to particularly sensitive data or critical business processes. Then check internal systems as well.
Security updates are available
The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Install the patched version for the relevant version line you are using, or a corresponding security update from your operating system or product provider.
For Linux distributions, security fixes can be backported to existing package versions. An unchanged PHP major version therefore does not automatically mean that the patch is missing. The exact package version and the security information provided by the respective provider are decisive.
Older PHP versions also require a fix. Check whether your provider offers security patches, or switch to a supported version.
The vulnerabilities
Recommendations
- Identify affected systems
Identify PHP installations, versions in use, accessibility and the operators responsible. Take into account integrated components and externally operated applications. - Install updates immediately
Apply the available security updates. Obtain confirmation of the fix from hosting providers and product manufacturers. - Update running services
After the update, restart the affected PHP services and any PHP processes running continuously. Containers may need to be rebuilt and redeployed. - Verify the fix
Check whether the applications actually running are using the patched PHP version or a package designated as fixed by the provider. - Check systems for anomalies
Examine logs and affected systems for unusual requests, crashes, modified files and unexpected processes. An update does not remedy any compromise that has already occurred.
If an immediate update is not possible
Where possible, restrict access to the affected applications to only those people and systems that actually require it. Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.
The vendor advisories describe additional transitional measures. These include disabling the PHP upload progress bar and, where operationally feasible, blocking multipart requests at the web server or upstream proxy. Such changes may affect uploads and forms and must be appropriate for the specific environment.
These measures only reduce individual attack vectors. They do not provide complete protection and are no substitute for security updates. Even a web application firewall alone is not sufficient.
Further Information
The NCSC updates its technical information on the Cyber Security Hub (CSH). The latest security information from the PHP developers, as well as from the relevant operating system, hosting and product providers, is authoritative for implementation.