3 stories for “PHP update”
CISA added the two critical PHP vulnerabilities to its list of actively exploited flaws and ordered federal agencies to patch by October 29. Those who cannot update are told to take their servers offline.
Many organizations do not know which PHP versions their servers run. A non-intrusive check that compares the version a server reports with the patched versions can give an initial picture. Moshe Levi of Levinity Cyber explains what it reveals, and what it does not.
Two severe PHP vulnerabilities allow remote code execution without authentication. Patches are out, exploitation attempts are already here, and there is no safe workaround.
