Security advisories.Patch what is exposed.
Short notes when a flaw needs action this week. The current alert is PHP. Two flaws let an attacker run code on a web server without a login.
Current advisories.
Start with the newest. Each note names the patch, who is exposed, and what to do if you cannot update today.
- Critical PHP patches: update nowTwo flaws let an attacker run code on a web server without a login. Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Keep session upload progress off until the next bugfix.
- Critical PHP patches: update nowTwo flaws let an attacker run code on a web server without a login. Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Keep session upload progress off until the next bugfix.
Read it. Then patch.
An advisory is an action list, not a news recap.
- Check the severity and the date
Critical means update today. The date shows when the vendor published the fix, and when we last added a follow-up.
- Match it to what you run
Many business sites run PHP inside WordPress or a custom app. If you are not sure, ask. The app name is not the PHP version.
- Patch, or take it offline
A partial setting is not a fix for a critical flaw. If the update cannot ship today, take that system off the internet until it can.
- Call us when EMPIST manages the server
We confirm the version and apply the vendor package. Sites you host somewhere else still need their own check.
About these advisories
What they are, and what managed clients should do.
01What is an EMPIST security advisory?
02How often do you publish advisories?
03If we are an EMPIST client, do you patch this for us?
04Where do the facts come from?
Not sure what your sites run?
Tell us what you host. We will confirm the version and the patch path. Managed clients can also call the service desk.