For Secure Development, PHP Updated

The maintainers of PHP have released two new versions of the scripting language that fix a number of bugs, to protect PHP developers from bugs, including the OpenSSL Heartbleed vulnerability.

Versions 5.4.28 and 5.5.12 both contain that important patch, as well as fixes for more than a dozen other vulnerabilities.

The vulnerability in OpenSSL is Heartbleed which is a memory leak that attackers can exploit on vulnerable servers to get access to 64KB of memory per request. Developers and site owners have been scrambling to fix the vulnerability for the last few weeks.

The repair for the Heartbleed flaw is in both PHP 5.4.28 and 5.5.12. Both versions also include a slew of other bug fixes, one of which is for CVE-2014-0185, a privilege escalation flaw. The bug could allow an attacker to run arbitrary code in some situations.

“Both default config and compiled-in defaults of sapi/fpm lead to configurations which easily allow any user with rights to connect to a UNIX socket to run arbitrary code with the permissions of the fpm user,” a description of the bug says.

Users of either version of PHP are encouraged to update to the fixed packages as soon as possible to protect themselves against potential attacks.