PHP has released security updates for versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9, fixing three critical vulnerabilities (CVEs) including a SQL injection in PostgreSQL extensions and a stack overflow in Phar archives. The updates, made available through Remi Collet's RPM repository, are essential for users, especially since PHP 8.1 has reached its end of life. The vulnerabilities addressed include a significant SQL injection risk, an out-of-bounds write affecting certain versions, and a stack overflow issue related to circular symlinks in Phar archives. Developers are urged to upgrade their PHP versions promptly to mitigate these security risks and take advantage of the latest features
PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9 Updates: Fix 3 CVEs in Fedora and RHEL Packages
PHP's July 30 security release fixes three CVEs, including a SQL injection in PostgreSQL extensions and a stack overflow in Phar archives. Remi Collet published corresponding RPM packages for Fedora ≥42 and Enterprise Linux ≥8 on July 31, covering PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33. The updates are available via remi-modular repository or as parallel Software Collections installations. PHP 8.1 has reached end-of-life, so users should upgrade to at least 8.2.33 immediately.
