ThinkFacility Sign in
  1. Home
  2. Security
  3. PHP
CriticalPHP

PHP 8.2 to 8.5: two remote code execution flaws, update now

Anyone running a PHP site or app: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed.

How to fix it

You haveUpdate to
< 8.2.35→8.2.35< 8.3.36→8.3.36< 8.4.27→8.4.27< 8.5.12→8.5.12

Check your version

Your PHP version
php -v

Update

Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade "php*"
Fedora / RHEL
sudo dnf upgrade "php*"
macOS (Homebrew)
brew update && brew upgrade php
Docker · 8.2
docker pull php:8.2
docker run --rm php:8.2 php -v
Docker · 8.3
docker pull php:8.3
docker run --rm php:8.3 php -v
Docker · 8.4
docker pull php:8.4
docker run --rm php:8.4 php -v
Docker · 8.5
docker pull php:8.5
docker run --rm php:8.5 php -v

If you can't update yet

No complete mitigation exists. PHP lists partial ones: set memory_limit=-1 where apps can't override it, and keep post_max_size low (8M without uploads). Only the update makes an install safe.

PHP 8.1 and older are out of support. The PHP security team posted minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves; otherwise ask your distribution or LTS vendor, since distributions got the patch in advance.

Debian and Ubuntu patch their own packages and keep their own version numbers, so after an apt update the version may still read lower than the fixed one. Check your distribution's security notice for the package version that has the fix.

Sources