Critical PHP flaws allow remote takeover of web servers; patches released
What happened. PHP fixed two critical flaws, found by Wiz Research with help from AI models, that let unauthenticated attackers run code on servers using versions 5.4 to 8.5.11. Patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and a public proof of concept exists.
Why it matters. PHP underpins WordPress, Drupal and many internal and vendor applications, so exposure is broad. Teams should inventory PHP across servers, containers and appliances, patch internet-facing systems first, and plan upgrades from versions 8.1 and older, which get no official fix.