The PHP Group and major cybersecurity coordination centers have issued an urgent security advisory disclosing a critical Remote Code Execution (RCE) flaw impacting multiple supported PHP branches. Rated at maximum severity under the Common Vulnerability Scoring System (CVSS), unauthenticated attackers can exploit this issue to execute arbitrary code on vulnerable servers.
Root Cause and Affected PHP Releases
The vulnerability stems from improper boundary verification within query argument sanitization and specific character encoding handlers. Affected branches include unpatched versions across PHP 8.1, 8.2, and 8.3 lines. Server setups utilizing FastCGI wrappers or exposed to customized multibyte locales face immediate elevated exploitation risk.
Remediation Guidance for System Administrators
Security releases addressing this vulnerability are available immediately. Administrators must execute package upgrades across their infrastructure without delay. For environments where immediate redeployment is restricted, deploying targeted WAF detection signatures to filter malicious request payloads is essential as an interim safeguard.