Critical PHP flaws put web deployments at risk

Two critical security flaws affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. With millions of websites relying on PHP, the vulnerabilities have broad implications for infrastructure maintainers. Apache deployments using mod_php face the highest risk because an exploit can trigger an unauthenticated request before any application code runs.

PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 include fixes for the vulnerabilities. Users are strongly encouraged to update PHP across their entire infrastructure, rather than limiting updates to a particular deployment type.

OpenAI’s GPT-5.6 Sol LLM aided the discovery through the Patch the Planet initiative, which helps software maintainers discover vulnerabilities, develop patches, and test software. The initiative uses extensive formal verification and agent-based checks to assess whether software behaves as intended and identify side channels that could bypass modern security protections.