php A field note by Vikrant Sharma
PHP is dropping emergency security patches across all supported versions
The PHP team announced critical security fixes for 8.1, 8.2, and 8.3 in the same week. That almost never happens.
The PHP team announced emergency security releases for all three supported branches on the same day. PHP 8.1.30, 8.2.25, and 8.3.13 are landing with fixes for what they are calling critical vulnerabilities.
What caught my attention is the coordinated timing. When a security patch hits every supported version at once, it means the bug exists deep in the interpreter, not in some edge-case extension. The advisory does not name the CVE yet, which suggests responsible disclosure is still in progress.
This is the kind of patch you apply before reading the changelog. If you run PHP in production and have not upgraded by Thursday, someone else will do the reading for you.
The HN thread is quiet so far. Two comments. That usually means either no one has reverse-engineered the patch yet or the fix is subtle enough that it needs time to sink in. My guess is the latter. Exploitability details will surface once researchers diff the commits.
PHP gets a bad reputation for historical security issues, but the current release cadence is tight. Supported versions get patched fast. The problem is the number of servers still running PHP 7.4, which went end-of-life in November 2022. Those installations are not getting this fix.
If you maintain a Laravel or WordPress stack, check your PHP version right now. Run php -v and confirm you are on 8.1 or newer. If the output starts with a seven, you have a harder conversation ahead.
