[The Ministry of Industry and Information Technology’s NVDB issued a risk warning on preventing extremely critical remote code execution vulnerabilities in PHP] On October 22, the Ministry of Industry and Information Technology’s Network Security Threat and Vulnerability Information Sharing Platform (NVDB) recently discovered that PHP has two extremely critical remote code execution vulnerabilities, which cause serious harm. PHP is an open source server-side scripting language widely used for web development. Because it contains two extremely critical remote code execution vulnerabilities, unauthenticated attackers can use it to remotely execute arbitrary code, causing server control, sensitive information leakage, business interruption and other hazards. The affected PHP range includes: 8.5 series <8.5.12, 8.4 series <8.4.27, 8.3 series <8.3.36, 8.2 series <8.2.35, 8.1 series and earlier versions. Currently, the PHP security team has fixed the vulnerability and issued a security bulletin. Relevant units and users are recommended to immediately conduct a comprehensive investigation, promptly upgrade to the latest security version, or take temporary protective measures such as temporarily going offline, turning off the session upload progress function, network isolation, and network access restrictions; strengthen network security monitoring and management, and promptly modify credentials such as account numbers, passwords, and keys to prevent the risk of network attacks.