最新のセキュリティ情報
4 ページ目
10月28日(金)
PHP 8.1.12 Released!
The PHP development team announces the immediate availability of PHP 8.1.12. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.12 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.0.25 Released!
The PHP development team announces the immediate availability of PHP 8.0.25. This is a security fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.25 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
9月30日(金)
PHP 8.0.24 Released!
The PHP development team announces the immediate availability of PHP 8.0.24. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.24 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.1.11 Released!
The PHP development team announces the immediate availability of PHP 8.1.11. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.11 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
9月29日(木)
PHP 7.4.32 Released!
The PHP development team announces the immediate availability of PHP 7.4.32. This is a security release. This release addresses an infinite recursion with specially constructed phar files, and prevents a clash with variable name mangling for the __Host/__Secure HTTP headers. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.32 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016
Project: Drupal core Project machine name: drupal Date: 2022-September-28 Security risk: Critical 18 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:All Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7 CVE IDs: CVE-2022-39261 Description: Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity. Drupal core's code extending Twig has also been updated to mitigate a related vulnerability. Multiple vulnerabilities are pos…
9月1日(木)
PHP 8.0.23 Released!
The PHP development team announces the immediate availability of PHP 8.0.23. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.23 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
7月21日(木)
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2022-015
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25276 Description: The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. This advisory is not cove…
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Arbitrary PHP code execution Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25277 Description: Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012 ) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-…
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25278 Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25275 Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file syst…
7月8日(金)
PHP 8.1.8 Released!
The PHP development team announces the immediate availability of PHP 8.1.8. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.8 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
6月11日(土)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011
Project: Drupal core Project machine name: drupal Date: 2022-June-10 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.21 || >= 9.3.0 <9.3.16 CVE IDs: CVE-2022-31042 CVE-2022-31043 Description: Updated 22:00 UTC 2022-06-10: Added steps to update without drupal/core-recommended . Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: Failure to strip the Cookie header on change…
6月10日(金)
PHP 8.0.20 Released!
The PHP development team announces the immediate availability of PHP 8.0.20. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.20 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
6月9日(木)
PHP 8.1.7 Released!
The PHP development team announces the immediate availability of PHP 8.1.7. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.7 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.4.30 Released!
The PHP development team announces the immediate availability of PHP 7.4.30. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.30 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
5月26日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010
Project: Drupal core Project machine name: drupal Date: 2022-May-25 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.20 || >= 9.3.0 <9.3.14 CVE IDs: CVE-2022-29248 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside…
4月21日(木)
Drupal core - Moderately critical - Access bypass - SA-CORE-2022-009
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25274 Description: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content.…
Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-008
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper input validation Affected versions: >= 8.0.0 <9.2.18 || >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25273 Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter cr…
4月14日(木)
PHP 7.4.29 Released!
The PHP development team announces the immediate availability of PHP 7.4.29. This is a security release for Windows users. This is primarily a release for Windows users due to necessarily upgrades to the OpenSSL and zlib dependencies in which security issues have been found. All PHP 7.4 on Windows users are encouraged to upgrade to this version. For source downloads of PHP 7.4.29 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
3月22日(火)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006
Project: Drupal core Project machine name: drupal Date: 2022-March-21 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.16 || >= 9.3.0 <9.3.9 CVE IDs: CVE-2022-24775 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites. We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has alr…
3月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core Project machine name: drupal Date: 2022-March-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8 CVE IDs: CVE-2022-24728 CVE-2022-24729 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (e…
2月18日(金)
PHP 8.0.16 Released!
The PHP development team announces the immediate availability of PHP 8.0.16. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.16 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.1.3 Released!
The PHP development team announces the immediate availability of PHP 8.1.3. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.3 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
2月17日(木)
PHP 7.4.28 Released!
The PHP development team announces the immediate availability of PHP 7.4.28. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.28 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004
Project: Drupal core Project machine name: drupal Date: 2022-February-16 Security risk: Moderately critical 12 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: >= 8.0.0 <9.2.13 || >= 9.3.0 <9.3.6 CVE IDs: CVE-2022-25270 Description: The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard pr…
12月15日(水)
Log4j Vulnerability Update
Log4j is a Java library by Apache used to log debug messages within applications. It's recently been featured in news outlets around the world due to a vulnerability (known as Log4Shell) that was discovered allowing remote code execution using a specific string.
12月13日(月)
The Online PHP Conference 2022
The Online PHP Conference 2022 takes place January 17-21, 2022. This time we interpret the term "conference" literally: over the course of a week, we dedicate each morning to a topic that we will discuss together with invited experts in an interactive discussion. The topics are Remote Teams, Data Privacy and Data Security, Supply Chain Management, Cloud and Operations, and Green IT. The discussions will be held in German. https://2022.phpconference.online/
11月19日(金)
PHP 8.0.13 Released!
The PHP development team announces the immediate availability of PHP 8.0.13. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.13 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
11月18日(木)
PHP 7.3.33 Released!
The PHP development team announces the immediate availability of PHP 7.3.33. This is a security release. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.33 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.4.26 Released!
The PHP development team announces the immediate availability of PHP 7.4.26. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.26 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
10月28日(木)
PHP 7.3.32 Released!
The PHP development team announces the immediate availability of PHP 7.3.32. This is a security release. All PHP 7.3 FPM users are encouraged to upgrade to this version. For source downloads of PHP 7.3.32 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
10月22日(金)
PHP 7.4.25 Released!
The PHP development team announces the immediate availability of PHP 7.4.25. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.25 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
10月21日(木)
PHP 8.0.12 Released!
The PHP development team announces the immediate availability of PHP 8.0.12. This is a security fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.12 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
9月24日(金)
PHP 7.4.24 Released!
The PHP development team announces the immediate availability of PHP 7.4.24. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.24 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
9月23日(木)
PHP 8.0.11 Released!
The PHP development team announces the immediate availability of PHP 8.0.11. This is a security release fixing CVE-2021-21706. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.11 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.3.31 Released!
The PHP development team announces the immediate availability of PHP 7.3.31. This is a security release fixing CVE-2021-21706.. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.31 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
8月26日(木)
PHP 7.4.23 Released!
The PHP development team announces the immediate availability of PHP 7.4.23. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.23 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.3.30 Released!
The PHP development team announces the immediate availability of PHP 7.3.30. This is a security release. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.30 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.0.10 Released!
The PHP development team announces the immediate availability of PHP 8.0.10. This is a security fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.10 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
7月1日(木)
PHP 7.4.21 Released!
The PHP development team announces the immediate availability of PHP 7.4.21. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.21 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.0.8 Released!
The PHP development team announces the immediate availability of PHP 8.0.8. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.8 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.3.29 Released!
The PHP development team announces the immediate availability of PHP 7.3.29. This is a security release. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.29 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
5月4日(火)
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.
4月30日(金)
PHP 7.4.18 Released!
The PHP development team announces the immediate availability of PHP 7.4.18. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.18 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
4月29日(木)
PHP 7.3.28 Released!
The PHP development team announces the immediate availability of PHP 7.3.28. This is a security release. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.28 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
4月28日(水)
Security: SQL Injection in SQL Server "LIMIT" / "OFFSET"
Today we have released security patches via Laravel 6.20.26 and 8.40.0. These patches resolve a security vulnerability that allowed SQL injection when unfiltered user input was passed directly to the...
3月19日(金)
Forge: Session Changes
On the morning of March 18th all Laravel Forge sessions were manually logged out. This was done so that we could enable a new security feature in Forge that allows you to manage other browser sessions...
2月4日(木)
PHP 7.4.15 Released!
The PHP development team announces the immediate availability of PHP 7.4.15. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.15 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.3.27 Released!
The PHP development team announces the immediate availability of PHP 7.3.27. This is a security release. All PHP 7.3 users are encouraged to upgrade to this version. For source downloads of PHP 7.3.27 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog