Update: PHP vulnerabilities remain a reason for immediate patching

Update: 22 October, 4:00 PM

Following our previous message regarding the two critical vulnerabilities in PHP, we are providing an update on the situation. Since the publication of our advisory and the release of security updates, several websites have been brought back online. Has your organization not yet installed the updates? If not, do so as soon as possible. As a precaution, keep any systems that are still vulnerable offline until you have installed the updates.

Potential exploitation

At this time, the NCSC-NL is investigating initial signs of successful exploitation. The situation could escalate quickly, as Proof of Concepts (PoCs) are known. This means it has been demonstrated that the vulnerability can be exploited. The use of artificial intelligence (AI) could potentially allow these vulnerabilities to be exploited even more quickly. This reinforces the urgency of installing the updates. We therefore strongly advise everyone to apply the patches immediately.

Install the security updates

You should therefore not wait for signs of exploitation but install the available security updates as soon as possible. Check which version of PHP your organisation is using and follow the instructions from the NCSC-NL and your software supplier. Please make use of our decision tree, which you will find further on in this notice.

It is important that organisations check as soon as possible whether their systems are vulnerable and apply the available updates. Until systems have been updated, they should be kept offline as a precaution.

Patches available

PHP has released patches for the PHP vulnerabilities. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Users of Linux distributions and LTS versions are advised to apply the security updates provided by their vendor.

PHP 8.1 and earlier versions are no longer supported on a regular basis by the PHP project. However, due to the severity of the vulnerabilities, the PHP team has made minimal source code patches available for PHP 7.4, 8.0 and 8.1.

Temporary mitigating measures

When immediate updating is not possible, temporary mitigations are available for both vulnerabilities. The PHP team emphasises that these measures only limit specific attack vectors and do not constitute a complete solution. Only installing a security update will fully resolve the vulnerabilities.

Decision tree with explanation

The NCSC-NL has drawn up a decision tree with an explanation on how your organisation can assess which measures you can take if you use PHP.

Further technical information on GitHub

The NCSC-NL has also set up a page on GitHub. Here you will find technical information about the vulnerabilities. This page is continuously updated by the NCSC-NL. You will also find a list of all PHP-related software products here, to help you identify which products are vulnerable.