Urgent/Critical: Upgrade your PHP!

Critical remote code execution vulnerabilities were announced yesterday by the PHP team, and all miniBB admins should take the closest attention to this issue.

There is no deal with miniBB itself, as also it doesn't depend on any PHP program you have.

The only-workaround is to update your PHP version either to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, which fix these vulnerabilities. Older PHP versions do not contain the fixes:

On your server, you should at least have PHP 8.2.35, but keep in mind that

So — switching to at least PHP 8.3.36 would be the reasonable move now.

Request this from your hoster!

Paul
What's your take on the fact that Ai-models (like GPT-5.6 and Gemini 4 Argon) broke this bug wide open?

As a developer, how does it feel knowing a critical heap was sitting right in the core php engine for years without anyone noticing?

Do you think Ai-based vulnerability hunting is going to make further developing open source code even worth of try?

If not sure, how do you expect this disclosure happen on miniBB website?

I'd really appreciate your answers.