According to Schneier on Security, PHP maintainers have released fixes for two critical vulnerabilities affecting multiple PHP versions. The updates address issues that can allow unauthenticated remote code execution. Affected versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All PHP installations serving web requests are considered at risk, which includes environments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The maintainers advise all users to update immediately due to the critical nature of the flaws. No additional details on exploitability, deployment timelines, or affected components beyond the listed server types were provided.
