The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online
Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that …
Context & Ripple Effects
PHP had planned a coordinated release for two vulnerabilities rated 9.2, while watchTowr researchers characterized them as remote-code-execution flaws. That schedule changed when CVE identifiers began circulating, shortening the time between disclosure preparation and public patch availability.
The early release follows Cloudflare's default WAF mitigations for customers, deployed about nine hours before public disclosure. PHP's account of the incident also frames the release as a security-process review, rather than only a version update.
First-order effects
- Operators of web request-serving PHP installations need to move to the fixed releases immediately; the two confirmed flaws permit unauthenticated remote code execution on affected deployments.
- Cloudflare customers receive a compensating control through the provider's WAF deployment, but that mitigation does not replace applying PHP's released security fixes.
Second-order effects
- The CVE circulation disrupted PHP's intended disclosure timetable, forcing the Foundation and infrastructure providers to coordinate mitigations before the planned patch window.
- Hosting providers and managed PHP platforms face pressure to identify exposed request-serving installations and accelerate their own rollout communications alongside PHP's releases.
Third-order effects
- The episode points to critical open-source vulnerability response becoming a joint operational process between upstream maintainers and edge-security providers, with public identifier leaks narrowing the value of embargoes.
- If projects formalize the process improvements PHP says it is pursuing, release readiness and pre-disclosure mitigations—not only patch quality—will become a larger measure of ecosystem security.
The trend: Critical open-source security response is shifting toward coordinated upstream patches and provider-side mitigations that can be activated when disclosure timing breaks down.