- This release is a security update that keeps outsiders from manipulating servers running PHP. According to the PHP project, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two vulnerabilities that let an unauthenticated attacker run code on the server under certain conditions.
- The first vulnerability corrupts internal data at the moment a request exactly reaches the memory usage limit (memory_limit). The second reuses memory from a previous request after a fatal error. The original article says remote code execution was demonstrated under default settings in an Apache mod_php environment.
- According to the original article, signs of the first issue first appeared during an external audit in 2024, but no actual attack path was confirmed at that time. Later reports from Calif, OpenAI, and Wiz revealed the scope of the impact, making it a top priority since August.
- On October 20, vulnerability IDs leaked first to forums and social media, so PHP moved up its advance notice and brought the release date forward by one day. A security firm accidentally published a proof-of-concept video, and according to the original article, Chainguard distributed an image containing the fix before public disclosure.
O: An administrator who runs PHP 8.4 or 8.5 on an internal web server may find this useful when comparing today's released version list with installed copies and deciding the update order using the php.net advisory.
X: The vulnerability description and attack possibility in this article are claims from the PHP project that announced the vulnerability, so the scale of damage should be read as the announcing party's explanation.