PHP Team Warns of Unpatched RCE Flaw, Issues Interim Configuration Mitigations

The PHP security team has warned of a newly disclosed remote code execution vulnerability that does not yet have an official patch. The flaw affects only certain non-default configurations, allowing an attacker to run arbitrary code on the server via a crafted request. In the absence of a fix, the team has published interim mitigations, including disabling risky functions and remote URL inclusion and restricting filesystem access. The alert comes amid other recent incidents, such as a compromised LiteLLM package distributing info-stealer malware and a Railway breach prompting secret rotation. Engineers are advised to audit non-default PHP settings, apply the recommended changes, and monitor for the forthcoming official patch.