An unauthenticated remote code execution flaw in PHP is already being exploited, but no affected versions, fixed release or severity score have been published yet, leaving defenders unable to patch.
Posts tagged: PHP Group
PHP Stale Internal Request-State Vulnerability
A memory-handling bug in PHP’s core request processing lets stale pointers from a freed request linger into the next one, giving unauthenticated attackers a path to remote code execution.