A security flaw has been identified in Twig, a widely used tool for building dynamic PHP websites. The vulnerability impacts Twig versions 2.16.x and 3.9.0 through 3.25.x.When a site uses Twig's sandbox security feature enabled via a source policy (rather than turned on globally for all templates), attackers who have the ability to edit or upload ...
Continue reading
A flaw has been identified in specific versions of PHP, the software that powers most dynamic websites. The issue affects PHP 8.4 releases older than 8.4.21, and PHP 8.5 releases older than 8.5.6.
The flaw is in PHP’s mbstring feature, which handles text encoding conversions and detection for website content. If input containing a hidden, ...
Continue reading
A security flaw has been identified in specific older versions of PHP, the software that powers most dynamic websites. The issue only impacts sites that use PHP's SOAP functionality (a tool for communicating with external services) with session persistence enabled, a feature that stores certain session data across user requests to improve ...
Continue reading
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in ...
Continue reading
