bibibi.ccLoading…
Connect scattered updates into a story you can understand.
The New York State Department of Financial Services issued alerts regarding critical PHP vulnerabilities known to be exploited, urging regulated entities to identify and remediate them as soon as possible.
A Chinese-language article discusses a recent PHP high-risk vulnerability that may expose Web3 security weaknesses in off-chain systems.
Binance stated that, following disclosure of the PHP security vulnerability, it proactively implemented protective measures and completed necessary remediation before the official patch was released, and will continue monitoring related developments.
MIIT NVDB warns that PHP two critical remote code execution vulnerabilities can be exploited by unauthenticated attackers, and recommends that affected organizations investigate, upgrade, or implement temporary protections as soon as possible.
PHP Foundation stated that 2024 fixes for critical security vulnerabilities first discovered in the year were repeatedly halted due to hesitant decision-making and insufficient resources.PHP has released emergency patches for related critical vulnerabilities, while some government websites and online services were temporarily taken offline to deploy the patches.
Google stated that Google Cloud itself has no vulnerabilities, but users running PHP on its platform may be at risk; it is updating the supported PHP version's serverless base image and urges customers to upgrade to PHP 8.2 or later and redeploy.
PANews reported that October 21 the Netherlands NCSC official website was temporarily inaccessible, while websites including those of the Dutch House of Representatives, the Finnish government, and the French CNIL experienced outages or shutdowns, and pixiv and Niconico entered emergency maintenance.
BlockBeats, citing Huntress, stated that PHP has been found to contain highest-severity remote code execution vulnerabilities, and officials moved up the security patch release because the information was leaked in advance. The affected versions, exploitation conditions, and whether the vulnerabilities have been exploited remain to be confirmed by officials.
SlowMist says that PHP disclosed CVSS v4.0-rated 9.2 vulnerabilities that could lead to remote code execution. The official security update is expected to be released on October 21 at 14: 00 UTC. The affected scope and exploitation conditions have not yet been officially confirmed.