We are aware of the reports highlighting regressions in a few of the recent official PHP security patches. The official PHP Group has not yet published an official position or updated patches addressing these reports. Mitigations remain in place to protect customers against the currently known attack paths, and we continue to monitor for further developments. No action is required from customers at this time.
The currently known regressions are:
1. Configuration-dependent RCE: A reported RCE demonstration affects PHP 8.5.12 (which may possibly affect earlier versions as well) under specific configurations. We have implemented mitigations that break the demonstrated exploit chain. Our customers remain protected against this specific attack path.
2. Memory-safety Regression: A separate, verified bug report identifies a potential double-free issue affecting PHP 8.4.27 and 8.5.12, which may cause crashes under specific conditions. This is currently a stability and memory-safety concern, not a critical security issue (e.g., remote code execution).
We are monitoring the situation and will continue to respond quickly to new vulnerability details or attack techniques as they emerge. If you have any questions, please reach out to our support team.