Source: thehackernews.com
Two critical PHP vulnerabilities collectively named PHP2Shell have been rated 9.2 out of 10 in severity and are scheduled for a patch release at 14:00 UTC on October 21. PHP has provided no official workaround prior to the fix. A setting being circulated in the security community as a mitigation has been clarified by the originating security firm to be insufficient on its own. Organizations are urged to apply the patch as soon as it becomes available. The flaws allow remote code execution (RCE), making them highly dangerous for any server running PHP. The article aims to clarify what partial mitigations may reduce risk in the window before patching and what measures are ineffective.
