The PHP security team has issued a warning regarding a new remote code execution (RCE) vulnerability that currently lacks an official patch. While the flaw does not affect all PHP installations, it poses a significant risk to systems running certain non‑default configurations (e.g., custom php.ini settings that broaden the attack surface).

The Vulnerability and Mitigation

According to the PHP security advisory, the vulnerability allows an attacker to execute arbitrary code on the server when a specially crafted request reaches a PHP process that has vulnerable configuration options enabled.…