The PHP project released emergency patches for two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale. CISA stated it was not aware of any exploitation, though researchers observed active reconnaissance across internet-facing systems. The flaws, dubbed php2shell, affect versions from 5 onward and were discovered using AI tools by Calif and Wiz. Security experts advise organizations to apply the new patches immediately to prevent potential server compromise.
Read the full story at cyberscoop.com.
Photo: 3844328 / Pixabay
