If you run Apache with mod_php, stop reading and patch now: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Two recently disclosed PHP vulnerabilities, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, involve improper cleanup of failed or interrupted requests and may enable remote code execution through memory corruption or stale global state. The first issue can reportedly be triggered by request-memory exhaustion and may affect Apache with mod_php before application code executes, while source analysis suggests PHP-FPM, FrankenPHP, and LSAPI could also be affected. The second issue requires a poisoned state producer and consumer to execute in the same worker, with demonstrated attack paths involving INI diagnostics and session upload progress in mod_php and, for one path, FPM. The source states that LLM-assisted research helped reproduce the issues using public information and warns that public exploits are emerging. Recommended remediation is upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, applying available backports for end-of-life releases only as a short-term measure, and planning a supported-version upgrade. Disabling session upload progress and using firewall rules may provide partial mitigation but are not considered sufficient substitutes for patching, while Semgrep Guardian is adding detection for vulnerable PHP versions and tools to help identify projects using PHP.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.