PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Summary
PHP will release an out-of-cycle security update today for two critical remote code execution vulnerabilities. These flaws have been assigned a CVSS v4.0 score of 9.2 and affect supported PHP branches 8.2 through 8.5. No exploitation has been reported to date.
IFF Assessment
The discovery of two critical unpatched remote code execution vulnerabilities in PHP poses a significant risk to systems relying on this widely used web development language, making it bad news for defenders.
Severity
The article explicitly states the CVSS v4.0 score is 9.2 and describes the vulnerabilities as critical remote code execution flaws, indicating a high severity and impact.
Defender Context
Defenders should prioritize patching their PHP installations immediately upon the release of the security update for these critical vulnerabilities. Systems running unsupported PHP versions will remain vulnerable, requiring careful inventory and migration planning. This highlights the ongoing risk associated with unpatched software and the importance of timely security advisories.