China's MIIT NVDB issues a risk alert on guarding against a critical PHP remote code execution vulnerability.

BlockBeats news, October 22 - The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of China's Ministry of Industry and Information Technology has detected two ultra-critical remote code execution vulnerabilities in PHP, which are severely harmful. PHP is an open-source server-side scripting language widely used for Web development. Due to the two ultra-critical remote code execution vulnerabilities, unauthenticated attackers can exploit them to remotely execute arbitrary code, causing harms such as server compromise, sensitive information leakage, and business interruption. The affected PHP ranges include: 8.5 series <8.5.12, 8.4 series <8.4.27, 8.3 series <8.3.36, 8.2 series <8.2.35, 8.1 series and earlier versions.

Currently, the PHP security team has fixed the vulnerabilities and released a security advisory. Relevant units and users are advised to immediately carry out comprehensive inspections, promptly upgrade to the latest secure versions, or adopt temporary protection measures such as temporary offline shutdown, disabling the session upload progress feature, network isolation, and network access restrictions; strengthen cybersecurity monitoring and management, promptly change credentials such as account names, passwords, and keys, and prevent cyberattack risks.