New security flaw found in PHP again, setting advised off; revenue department's tracking system shut temporarily

A new security vulnerability has again been found in the programming language PHP, and a server feature has been recommended to be disabled. According to a notice issued by PHP on Friday, attackers can exploit this flaw to run unauthorized code on web servers. However, this risk appears only in specific configurations combined with matching application code. Servers where the serialize handler is changed before a session starts and where the session upload progress feature is active are at risk, the notice says.

PHP has urged users to keep the feature disabled until a regular update is released. The previous notice on October 21 had suggested the same measure, so those who disabled the setting then do not need to do anything further. Such situations are said to be rare in practice, and the issue will be fixed through a regular bug fix rather than an emergency update.

Meanwhile, after the National Cyber Security Centre flagged a serious vulnerability in PHP, the Department of Revenue Investigation has temporarily shut down its Vehicle Consignment Tracking System. The department said that as long as the system remains shut, vehicles can operate by carrying the required invoices and bills, and the service will resume once the security update is applied. Once the system is back up, transport-related details must be entered into it as soon as possible, the department's notice states.