So after the 2 remote code execution (RCE) are fixed, I have seen two new security issues one seems to be DoS the other RCE in the new 8.5.12.
Quote:
|
https://github.com/rafalohaki/php2shell-poc
|
Some are saying unpatchable based on it being in FastCGi Process Manager (FPM).
Seems narrow though:
Quote:
This is not universal RCE. It is an LFI amplifier that works on a narrow class of applications: those that include() a user-controlled path without appending an extension, with cleanup=Off.
In public code the pattern include($x . '.php') dominates, which is why this technique has a small real-world surface.
|
We should keep a close watch on PHP though as it is getting a lot of scrutiny and I would not be surprised if more severe flaws are found
Latest info on updating and protecting servers:
Quote:
|
https://github.com/syhunt/php2shell-protection#public-research-update-configuration-dependent-rce-demonstration-on-php-8512-22-october-2026
|