Specially crafted HTTP requests may allow remote code execution, exposure of data from other requests, or denial of service. Vercel says working public exploits are available and exploitation attempts have been reported across the industry.
The flaws affect PHP 5.4 and later in default configurations. The bulletin names WordPress, Drupal, Laravel, and Magento as affected when running on a vulnerable PHP runtime. Patched releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Vercel advises updating the runtime immediately; changing application code or plugins is not sufficient. PHP 8.1 and earlier no longer receive regular updates from the PHP project.
Vercel says it deployed WAF rules before disclosure. They apply automatically at no cost to projects on Vercel, including PHP functions deployed there and requests proxied or rewritten to external PHP backends. The rules block known exploit patterns but do not cover requests that bypass Vercel’s network or replace patching. The bulletin does not establish the number of compromised systems or quantify the scale of attacks.