9,2 / 10Critical severityTwo vulnerabilities in the PHP core. Fixes are already available.
Protect your website: update PHP
Under certain conditions, an attacker can execute code on the server without a login or password. The website, passwords, keys and any other data the PHP process can access are at risk.
Fixed releases:
- 8.2.35+
- 8.3.36+
- 8.4.27+
- 8.5.12+
Leave the update to specialists
We’ll check your website and server, update PHP, the CMS and extensions with compatibility in mind, and fix any other vulnerabilities we find.
Technical details
Install the fixed release of your branch or your OS vendor’s patched package; there is no need to move to 8.4 specifically. PHP 8.1 and earlier have no official fixes — check for a vendor patch or plan a move to a supported branch.
Updating the CMS alone is not enough: PHP itself must be fixed on the server. Before updating, make a backup and check compatibility; afterwards, restart the PHP services (PHP-FPM, web server) and test your websites.