BlockBeats report, October 22: According to the official PHP security advisory, website operators should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 based on their respective branches, or install the corresponding patched packages provided by their distribution. Users of PHP 8.1 and earlier versions should upgrade to a supported branch or contact their distribution or long-term support provider to confirm patch availability for older versions.
Regular users can follow CISA’s general security recommendations: enable two-factor authentication on important accounts such as email and financial accounts; use unique, strong passwords for each account and avoid password reuse; be cautious of phishing emails impersonating “urgent password reset notices,” and when changing your password, manually open the official website or app instead of clicking on suspicious links. These measures help reduce the risk of account theft and phishing, but they cannot fix the server-side PHP vulnerability.
Cloudflare has notified that the vulnerability resides in the server's PHP runtime environment and cannot be fixed by updating only website code or plugins. Users of hosted services should contact their provider to confirm that the underlying PHP has been updated. Cloudflare has announced the addition of complete HTTP transaction detection and response rules to its Web Application Firewall (WAF), available to all customers, including those on the free plan. During the remediation period, WAF protection should remain enabled; however, measures such as the WAF and upload restrictions cannot replace the necessary patch.
The cybersecurity firm Huntress recommends that businesses conduct a comprehensive inventory of PHP environments across servers, control panels, and third-party software, prioritizing the remediation of publicly accessible systems. For versions that cannot be patched promptly, consider temporarily isolating them from public access. Additionally, monitor for anomalous PHP process behaviors such as unusual command-line executions, interpreters, or download tools; upon detecting suspicious activity, isolate the server and retain website and PHP logs.