What needs a response, and what can wait.

Two flaws in the PHP runtime itself let an attacker run code from an ordinary web request with no login. Both are being exploited, so internet-facing PHP needs an out-of-cycle response and internal-only PHP does not.

• Internet-facing PHP (Apache mod_php or PHP-FPM)Tier 1
• Internal-only PHPTier 4

Internet-facing PHP (Apache mod_php or PHP-FPM): Out-of-cycle response: patch PHP and restart every worker. If you cannot patch at once, apply PHP's configuration workarounds first.

A crafted request to the SSL remote access VPN can make a Cisco ASA or FTD firewall reload, with no login, when secondary authentication is configured on a tunnel group. It is being exploited. The only effect is an outage, not a breach, so it matters most where the VPN is business-critical.

• All conditions true, VPN is business-criticalTier 2
• All conditions true, VPN is a backupTier 3
• Any condition falseTier 4

All conditions true, VPN is business-critical: Out-of-cycle: upgrade, or apply Cisco's mitigation first if you cannot upgrade yet.

Red Hat says a race in the Linux kernel's IPv4 TCP code lets an unauthenticated remote attacker corrupt kernel memory. Researchers report remote root against servers with an MPTCP listener, but the exploit is not public and no exploitation is reported.

• Internet-facing server with an MPTCP listenerTier 2
• Internet-facing server without an MPTCP listenerTier 3
• Internal-only serverTier 4

Internet-facing server with an MPTCP listener: Handle ahead of your normal cycle. Patch the kernel and reboot.

A memory-corruption flaw in the Brotli decoder can let an attacker crash, read from or possibly run code in applications that decompress attacker-supplied Brotli data. CISA lists it as exploited, but no source reviewed reports code execution in the wild. It is rated Tier 3, an editorial call.

• Application that decodes untrusted Brotli dataTier 3
• Only decodes Brotli from sources you controlTier 4
• Never decodes untrusted BrotliTier 4

Application that decodes untrusted Brotli data: Prioritised: sooner than your normal patching cycle, schedule it. Update every affected runtime and library, rebuild container images and restart processes. If you cannot soon, block Brotli-compressed input first.