December 8th, 2008
PHP 5.2.7 removed from distribution over security bug
The open-source PHP Group has removed PHP version 5.2.7 from distribution because of a security bug that affects certain configurations.
According to a notice from the Apache-backed project, PHP users should use version 5.26 until PHP 5.2.8 is released with a fix for this issue.
Due to a security bug found in the PHP 5.2.7 release, it has been removed from distribution. The bug affects configurations where magic_quotes_gpc is enabled, because it remains off even when set to on. In the meantime, use PHP 5.2.6 until PHP 5.2.8 is later released.
The magic quotes feature has been deprecated and removed as of PHP 6.0.0. “Relying on this feature is highly discouraged,” PHP warns.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
