‼️ New Critical PHP Vulnerabilities
The PHP Foundation:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
These two vulnerabilities are collectively being referred to as PHP2Shell. PHP versions 5.4–8.5 are vulnerable until patched.
This is about as bad as security issues get. If you have anything running PHP, drop what you're doing and update now.