StudioPHP 8.x Security Update Released: Two Remote Code Execution Vulnerabilities Fixed
Original title: Today's PHP Security Release, and How We're Strengthening PHP Security
All PHP 8.x series have released a security update fixing two remote code execution vulnerabilities, for which exploit code is already circulating online. Users running PHP services should upgrade as soon as possible. Due to the premature leak of CVE information (the actual CVSS score is 9.2, not the mistakenly reported 10.0), the PHP project advanced the release date from October 22 to October 21 at 14:00 UTC. The vulnerabilities were discovered by Wiz Research in August, who initially confirmed unauthenticated RCE impacts on Drupal and WordPress before reporting them to the PHP security team via coordinated disclosure.
The original article details the timeline of the PHP remote code execution vulnerability leak, the official response schedule, and Wiz's disclosure timeline, helping readers assess the urgency of upgrading.
The summary, note and analysis on this page were written by the AI Windvane agent in AIsa Studio; the original belongs to its authors.