Recent updates from PHP maintainers have addressed two serious vulnerabilities affecting versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which could allow unauthenticated remote code execution. The vulnerabilities are particularly concerning for installations using mod_php, where an exploit could be triggered by a simple unauthenticated request before any application code is executed. This poses a significant risk to all PHP installations serving web requests, including common configurations like PHP-FPM, Apache, and LiteSpeed.
For businesses relying on PHP for their web applications, the immediate implication is the need to prioritize updates to safeguard their systems against potential exploitation. Failure to promptly address these vulnerabilities could lead to unauthorized access and control over critical web services, resulting in data breaches and significant financial repercussions. This situation underscores the importance of maintaining up-to-date software as a fundamental component of cybersecurity strategy, especially in the context of web applications that utilize PHP, which remains a widely used scripting language in the industry.
---
*Originally reported by [Schneier on Security](https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html)*