PHP has published a security update to address a critical security issue involving two vulnerabilities that may allow attackers to execute commands on any web server running PHP.

PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.

The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed but requires that the affected versions be updated.

Vendors across the globe are working to patch any hosted solutions running PHP and in some cases may require you to push out a provided patch, but in many cases the vendor will handle the update on their end. The primary concern for you is any websites your business owns, wherever they are hosted.

The following list contains the primary affected vendors/tools but does not eliminate the possibility that you are running PHP somewhere in your environment: