The Ministry of Industry and Information Technology's NVDB Issues Risk Advisory on Preventing Critical PHP Remote Code Execution Vulnerabilities

Odaily reports: Recently, the National Vulnerability Database (NVDB) of the Ministry of Industry and Information Technology's Cybersecurity Threat and Vulnerability Information Sharing Platform monitored and discovered two critical remote code execution vulnerabilities in PHP, which are severely harmful.

PHP is an open-source server-side scripting language widely used for web development. Due to the existence of two critical remote code execution vulnerabilities, unauthenticated attackers can exploit them to remotely execute arbitrary code, causing harm such as server compromise, sensitive information leakage, and business interruption. The affected PHP ranges include: 8.5 series < 8.5.12, 8.4 series < 8.4.27, 8.3 series < 8.3.36, 8.2 series < 8.2.35, 8.1 series and earlier versions.

Currently, the PHP security team has fixed the vulnerabilities and released a security advisory. Relevant organizations and users are advised to immediately conduct comprehensive inspections, promptly upgrade to the latest secure versions, or adopt temporary protective measures such as temporary offlining, disabling the session upload progress feature, network isolation, and network access restrictions; strengthen cybersecurity monitoring and management, promptly change credentials such as account names, passwords, and keys, and prevent cybersecurity attack risks.