PHP team warns of unpatched RCE vulnerability

The PHP security team has warned about a remote code execution vulnerability with no official patch yet. It affects only non-default php.ini configurations; interim mitigations include disabling expose_php, allow_url_fopen and allow_url_include, restricting disable_functions and setting open_basedir.

• The RCE flaw affects only non-default php.ini configurations
• No official patch is available; interim mitigations are recommended
• Disable allow_url_fopen, allow_url_include and expose_php
• Restrict open_basedir and risky functions such as exec and system