CVSS 9.2 (CRITICAL) · Actively exploited (listed in CISA KEV) · Affects: PHP
PHP contains a critical vulnerability where global state may reference freed request memory due to incorrect reset mechanisms. This flaw allows attackers to trigger remote code execution by exploiting stale state before full initialization.
Successful exploitation enables remote code execution, leading to complete server compromise and data breach.
Immediately apply vendor-provided mitigations and ensure compliance with CISA BOD 26-04 patching guidelines.
PHP 存在嚴重漏洞，全局狀態可能因重置不當而引用已釋放的請求記憶體。攻擊者可利用此未初始化的陳舊狀態觸發遠端程式碼執行。
立即套用供應商提供的緩解措施，並確保符合 CISA BOD 26-04 的修補指南。