Skip to content
BlackFog Responds to Critical PHP Vulnerabilities
BlackFog has patched all its servers to address the critical PHP vulnerabilities disclosed this week. The security updates have been applied across our server infrastructure as part of our commitment to protecting the systems that support our customers and operations.
On October 21, the PHP project released fixes for two critical vulnerabilities that could allow an unauthenticated attacker to execute code remotely. Both involve memory handling during web request processing, potentially allowing attackers to compromise affected servers.
The vulnerabilities affect PHP deployments serving web requests, including PHP-FPM and Apache mod_php. The PHP team considers the risk highest for mod_php, where a demonstrated exploit can trigger an attack before application code runs. Updating the underlying PHP runtime is therefore essential; application-level protections are not a substitute for patching.
Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations using distribution-managed packages should check their operating system vendor’s security updates for the corresponding fixes. The PHP project states that updating is the only complete solution.
For organizations still assessing their exposure, the priority is to identify PHP-powered services, apply the appropriate updates and verify that running services are using patched versions. Critical vulnerabilities require prompt remediation, not reliance on temporary workarounds.
