PHP Releases Security Updates To Fix Remote Code Execution Holes
PHP has released security updates to address two remote code execution holes, following a leak in the coordinated disclosure process. The updates are vital for users running PHP 8.x.
Original reporting · simonwillison.net
Original: “Today's PHP Security Release, and How We're Strengthening PHP Security”
Read “Today's PHP Security Release, and How We're Strengthening PHP Security” at Simon Willison →How this was written. Content Memory wrote this article with a language model from Simon Willison’s reporting (model: @cf/meta/llama-3.3-70b-instruct-fp8-fast); it describes that reporting rather than adding to it. The original, linked above, is the full story.
Key points from Simon Willison’s report
- PHP has released security updates to address two remote code execution holes following a leak in the coordinated disclosure process.
- The leak occurred on Tuesday, October 20th, and included wrong release time and CVSS score information.
- Users running PHP 8.x must upgrade to the latest version as soon as possible to protect themselves from potential attacks.
- The PHP project brought its pre-announcement forward and moved the release to October 21st to mitigate the impact of the leak.
- The situation highlights the importance of a coordinated disclosure process in preventing the exploitation of vulnerabilities.
PHP has released security updates across the entire PHP 8.x line to address two remote code execution holes, according to Simon Willison. The updates are crucial for users running PHP, as exploits have been circulating since the leak in the coordinated disclosure process. This leak has led to accelerated development of various proof of concepts, increasing the risk of attacks.
The leak occurred on Tuesday, October 20th, at around 15:00 UTC, when two CVE IDs began circulating on online forums and social media. The leaked information included a wrong release time and a wrong CVSS score of 10.0, which is higher than the actual score of 9.2. Fortunately, no technical details were leaked, limiting the initial damage.
In response to the leak, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. The release was also moved from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC, in an effort to mitigate the impact of the leak. This swift action aimed to protect users by providing them with the necessary security updates as soon as possible.
However, the leak and pre-announcement led to further complications. Around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published a video showing their proof of concept working against several targets. Although the video was deleted, copies started circulating on social media soon after, revealing limited details about the vulnerabilities.
The video contributed to the accelerated development of various proof of concepts, which increased circulation on October 21st. This has heightened the risk of attacks, making it essential for users to upgrade their PHP versions as soon as possible. The PHP Foundation has explained the situation in a post, providing users with the necessary information to take action.
The situation highlights the importance of a coordinated disclosure process in preventing the exploitation of vulnerabilities. The leak and subsequent events have led to a challenging situation, but the PHP project's swift response has helped to mitigate the damage. Users must now take action to protect themselves by upgrading to the latest PHP version.
The security updates are a crucial step in strengthening PHP security, and users must take immediate action to apply them. By doing so, they can protect themselves from potential attacks and ensure the security of their systems. The PHP project's efforts to address the vulnerabilities and prevent future leaks are ongoing, and users can expect further updates and improvements in the future.
Questions and answers
What happened to the coordinated disclosure process?
The coordinated disclosure process was leaked, resulting in the circulation of two CVE IDs on online forums and social media.
What did the leaked video show?
The leaked video showed a proof of concept working against several targets and revealed limited details about the vulnerabilities.
Why is it important to upgrade PHP versions?
Upgrading PHP versions is crucial to protect users from potential attacks, as exploits have been circulating since the leak in the coordinated disclosure process.
