The two reported flaws can let an unauthenticated attacker execute code on a vulnerable PHP server, creating a risk of credential theft and other attacks against visitors; PHP rates both critical and says the exploit requires certain conditions (PHP, PHP Foundation).

The two reported flaws can let an unauthenticated attacker execute code on a vulnerable PHP server, creating a risk of credential theft and other attacks against visitors; PHP rates both critical and says the exploit requires certain conditions (PHP, PHP Foundation).

PHP released fixes on October 21 for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; site operators should update PHP, while visitors should be cautious about entering credentials or connecting a crypto wallet on unfamiliar sites, as advised in the supplied reporting (Cointelegraph, WuBlockchain).

The available materials do not establish that visiting a site alone compromises a visitor’s device or specify further visitor precautions.