From The Hacker News
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own
Publisher-provided RSS excerpt. This is not the full article or an independently verified AEGLIX assessment.
Read the full story at The Hacker News ↗ (opens in a new tab)