PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2)

Security
1

Hi everyone,

With the recent reports about PHP vulnerabilities and an announcement expected on php.net today at 14:00 UTC, what should AlmaLinux server administrators do at this stage?

Could the AlmaLinux team clarify:

  • Which AlmaLinux versions and PHP streams are affected?

  • Are there any recommended temporary mitigations while we wait for patches?

  • What actions are planned on the AlmaLinux side, and when can we expect updated packages?

  • Will fixes be made available in testing repositories before reaching the stable repositories?

Any guidance would be appreciated.

Thanks,
Mateusz

2

This is already clarified on the blog.