There were two severe vulnerabilities found in PHP which is the runtime environment for LAM. Although there is no issue in LAM's own code, you need to make sure that the latest PHP patches are installed.
- LAM installations with packages (e.g. DEB/RPM/tar.bz2): please update PHP and restart your web server. Your Linux distribution should have published updated packages already.
- Docker: we published updated Docker tags shortly after the fix was available. The patched tags are stable/latest/9.7. If you are on a version before 9.7 then please upgrade to 9.7.
See here for details of the security issues. As the vulnerabilities are located in the core of PHP, there is no possibility to mitigate this with any code change in LAM. You need to update PHP itself as described above.
