The Ministry of Industry and Information Technology's National Vulnerability Database (NVDB) has identified two critical remote code execution vulnerabilities in the PHP programming language. These flaws allow unauthorized attackers to execute arbitrary code, potentially leading to server compromise, data leaks, and service disruptions.
The affected versions include PHP 8.5 prior to 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35, and all versions of 8.1 and earlier. The PHP security team has already released patches to address these issues.
Authorities recommend that users and organizations update their systems to the latest secure versions immediately. If an immediate update is not possible, temporary protective measures such as network isolation, restricting access, or disabling the session upload progress feature are advised.
