On September 3, Multi-State Information Sharing and Analysis Center (MS-ISAC) has issued an alert related to multiple vulnerabilities that could allow for arbitrary code execution and a recommendation that all sites using PHP should update to the latest PHP version ASAP (full alert is available here).
Read on for impacts and steps for Magento Commerce sites:
Magento Commerce hosted on our Cloud product
If you are using Magento Commerce on our cloud infrastructure, please work with your technology team to redeploy Magento Commerce starting September 19 in order to take advantage of the update. We recommend that Merchants complete this redeployment by September 30 in order to avoid PCI compliance issues that may go into effect as a result of these vulnerabilities at the end of the month.
Magento Commerce on all other hosting solutions
Since Magento Commerce relies on PHP, we recommend that all Merchants using Magento Commerce review necessary updates for PHP with their hosting provider. We also recommend that Merchants complete this review and any updates by September 30 in order to avoid PCI compliance issues that may go into effect as a result of these vulnerabilities at the end of the month.
Per the alert, recommended patches for this vulnerability include:
PHP 7.1: https://www.php.net/ChangeLog-7.php#7.1.32
PHP 7.2: https://www.php.net/ChangeLog-7.php#7.2.22
PHP 7.3: https://www.php.net/ChangeLog-7.php#7.3.9
If you would like more information on PHP and recent releases, you can visit PHP’s site. And if you have questions or would like more information on best practices for security, please check out our DevBlog article on Security.