Swedish cyber centre urges website operators to fix critical PHP flaws

Website operators in Sweden should urgently fix two critical flaws in PHP, software used to run websites, or temporarily disconnect affected services. Security updates were released on Wednesday afternoon.

John Billow, head of Sweden’s National Cyber Security Centre, gave that warning to Sveriges Radio. Public release of the technical details could make unpatched systems easier to attack.

The PHP project says the flaws can allow attackers to run code remotely without logging in. It urges immediate updates for installations that handle web requests.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website administrators using distribution or long-term-support packages should check their supplier’s updates; older versions may require a supported upgrade or a vendor-provided fix.

The project says an update is the only complete solution. Its temporary mitigation measures reduce specific attack routes but do not make an affected installation safe.

DailySweden

DailySweden's desk of editors, reporters, researchers and investigative journalists. We bring readers factual, truthful and objective reporting on the issues that matter to them.

Contact the editorial desk ›