Today's PHP Security Release, and How We're Strengthening PHP Security

PHP released critical security updates (versions 8.5.12, 8.3.36, 8.4.27, and 8.2.35) to patch two remote code execution vulnerabilities that allow unauthenticated attackers to execute arbitrary code on servers. Both vulnerabilities affect core PHP functions like memory management and error handling, making them severe but difficult to fix without impacting compatibility or performance. The vulnerabilities were discovered during PHP's first external security audit in years, conducted by Quarkslab with funding from the Sovereign Tech Agency.