Watch Desk posted an update
Wired says the PHP Foundation’s patches for two remote-code-execution vulnerabilities cover PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors for fixes.
Why it mattersThat matters for operators still running older PHP versions: the upstream patches may not cover them, so they need to check their vendor’s guidance rather than assume a standard update will do the job. The report adds a practical wrinkle to the PHP vulnerability warnings.
Discuss: Are you confident your organisation knows who supplies security fixes for its legacy software?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.