Critical PHP Fixes Put Crypto Checkout Infrastructure In Focus
Summary
PHP released fixes on October 21 for two critical vulnerabilities that could enable unauthenticated remote code execution, urging users to update. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; web-facing installations, particularly Apache mod_php, are highlighted as at risk. Crypto merchants using PHP-based storefronts alongside services such as BTCPay Server should verify their hosting environment is patched. The advisory does not report a Bitcoin or BTCPay Server compromise, or any stolen funds.
