HackerOne Patches Known PHP Vulnerabilities and Invites Researchers to Verify Fixes
· 7:26 · Watch on YouTube ↗
Summary
HackerOne says it patched and confirmed all known PHP vulnerability instances in its operated infrastructure by October 22 and is inviting researchers to check for missed exposure. Customers are urged to inventory PHP, apply fixes, and verify them.
Key points
- The video discusses two critical PHP runtime vulnerabilities that can allow unauthenticated remote code execution; one described attack path can occur before application security controls apply.
- Organizations are advised to identify PHP across owned infrastructure, managed hosting, partner applications, and appliances, and determine who is responsible for patching each instance.
- HackerOne says it applied upstream fixes to infrastructure it operates and confirmed all known PHP vulnerability instances there were patched as of October 22.
- For third-party environments, the guidance is to ask providers to confirm patch status; temporary mitigations are not a substitute for security updates.
- PHP 8.1 and earlier no longer receive regular upstream security updates, according to the discussion; organizations should check for vendor-supported fixes or plan to move to a supported version.
- HackerOne added PHP to the scope of its bounty program submissions and invites researchers to test authorized systems for instances its internal teams may have missed.
Article Details
- Topics
- [00:19] Critical PHP runtime vulnerabilities and unauthenticated remote code execution
- [02:04] Finding PHP exposure across owned and third-party environments
- [02:59] HackerOne's patching and provider-confirmation response
- [03:56] Customer guidance on inventory, fixes, and older PHP installations
- [05:14] Bug bounty scope and independent researcher validation