Fixes are already live across all supported versions. PHP security issues affects all major versions like 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because of the severity of these issues, we’re spreading the word so you can patch your environments right away. If you have any projects running unpatched PHP versions, please update them as soon as you can.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
More details can be found at PHP.net
Example for updating Debian php8.4-fpm
# update and upgrade packages
sudo apt update
sudo apt upgrade
# restart and validate php fpm status
sudo systemctl restart php8.4-fpm
sudo systemctl status php8.4-fpmStay safe!