Cloudflare reports early attacks on two critical PHP flaws
Both flaws are scored CVSS 9.2; the PHP security release is set for October 21 at 14:00 UTC, with no CVE ids given.
1
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #pre-patch
PHP session upload-progress use-after-free posted before a patch
The author publishes a public framework and says stock PHP 8.2.34 and 8.4.4 can reach code execution.
6