The PHP project recently issued a security update via its GitHub repository, releasing version 8.2.35. This update was prompted by a coordinated effort between researchers and security providers—including Wiz and OpenAI—to address several high-severity vulnerabilities in the open-source programming language. These flaws were reported to potentially allow for Remote Code Execution (RCE), particularly when using certain Server Application Programming Interfaces (SAPIs) like mod_php.
The technical response involved adding malloc fail checks throughout the codebase. However, the rollout faced scrutiny due to what some observers described as a 'botched' release; one commenter noted that the commit appeared not to belong to any branch on the main repository at first glance. Furthermore, while backports were provided for older versions such as 7.4, 8.0, and 8.1, many users reported difficulties obtaining the new packages through standard distribution channels like Ubuntu LTS or Fedora immediately upon release.
Administrators have been forced into various mitigation strategies while waiting for official patches. Some chose to take servers offline entirely to prevent breaches, while others implemented manual configurations. For example, one user suggested disabling `session.upload_progress` and blocking multipart request bodies at the web server level (e.g., Apache or Caddy). While these measures can block common attack vectors associated with memory exhaustion and RCE, they may break legitimate functionality, such as file uploads. The situation has highlighted ongoing concerns regarding the speed of patching critical infrastructure versus the risks posed by zero-day vulnerabilities.