Critical PHP Vulnerabilities Enable Unauthenticated Code Execution

Two critical PHP vulnerabilities allow attackers to execute arbitrary code on vulnerable web servers without authentication. The flaws stem from improper memory handling—stale data persists after being freed, and subsequent requests processed by the same worker thread can leverage this leftover information for code execution. Both vulnerabilities carry a CVSS score of 9.2 and affect PHP versions 8.2 through 8.5, with patches available across supported release lines. The default-enabled Session Upload Progress feature provides a confirmed attack vector.

The attack surface spans Apache module deployments, PHP-FPM, and other configurations, affecting servers at enterprises, governments, nonprofits, and critical infrastructure. Coordinated disclosure failed when a proof-of-concept tool leaked early, accelerating both defender and attacker responses. WatchTowr has already observed exploitation attempts in the wild. Organizations running unsupported PHP versions face harder choices—they must either upgrade to maintained branches or apply backported fixes, leaving many small organizations and underfunded institutions vulnerable during the transition period.

The incident exposed structural challenges in open source security. The PHP Foundation responded rapidly, even providing fixes for unsupported versions, earning praise for practices most commercial vendors avoid. However, the bottleneck extends beyond the project itself: PHP gets packaged and shipped by distributions and hosting providers often staffed by volunteers or small teams, making enterprise-scale patching slow and uneven. The situation echoes past incidents like Log4Shell, highlighting how critical open source components remain underresourced despite their central role in internet infrastructure.