If you run PHP anywhere, block out some time this afternoon. The PHP project is shipping a security release on October 21 at 14:00 UTC (16:00 in Central Europe) that fixes two critical vulnerabilities. According to the announcement, both allow attackers to run arbitrary code over the network. This is not the kind of patch you save for the next maintenance window.
Warnings, but no details yet
Several organizations, including CERT-EU, have already told their subscribers to update quickly, while holding back technical specifics until the release. What is known is that the issues are not tied to a single branch. They reportedly affect every PHP version since PHP 5.
A proof of concept is already circulating. It only targets one server API, LiteSpeed's lsphp8, and so far it has not been reproduced in lab environments. Don't take that as reassurance. Once the details go public, working exploits are likely to follow within hours, a few days at most.
No workaround, only the update
One tip making the rounds is to set session.upload_progress.enabled = 0. Based on current information, that does not help. There is no configuration change that buys you time.
Here is what you can do right now:
- Inventory every system running PHP, including dev and staging boxes.
- Watch your distribution's package repositories and install the new PHP packages as soon as they land.
- Rebuild and redeploy any container images that bundle PHP.
- After updating, confirm the new version with
php -vand restart PHP-FPM or your web server.
If you can't accept any risk of compromise in the meantime, the only hard option left is to take PHP-powered web servers offline until the fix is in. For most teams, though, the plan is simple: patch promptly this afternoon, then take a closer look at your logs.