PHP project issues critical security release; sites urged to update
Original title: Critical PHP Security Release
Two critical flaws affect any PHP application; no WordPress update is planned, and PHP before 8.2 is unsupported.
WordPress reports that the PHP project shipped a security release fixing two critical vulnerabilities. Hosts may already be updating PHP and adding WAF rules, but site owners should still check and update. The flaws are not WordPress-specific. PHP versions before 8.2 no longer receive security updates, and quoted UK NCSC guidance says to consider taking a system offline if it cannot be remediated immediately.
Unconfirmed: The notice does not name the flaws, CVE identifiers, affected ranges, or fixed versions.
- WordPress users can check PHP under Tools > Site Health > Info > Server.
- No WordPress update is required or planned for these issues.
- Several national cyber security agencies are publishing the same advice.
- Self-hosted sites on PHP before 8.2 should consider going offline while upgrading.
Impact: Critical PHP flaws; attacker impact not described
| Product | Affected |
|---|---|
| PHP | — |
- 1.Update PHP immediately and confirm the version with your host or Site Health.
- 2.If immediate remediation is not feasible, consider taking the system offline.
- 3.Plan an upgrade if the server runs PHP before 8.2, which no longer gets security updates.
- Products
- PHP
- Countries
- United Kingdom
From the original article
1 min read at wordpress.org
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
By John Blackbourn · wordpress.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.