A critical unauthenticated remote code execution vulnerability in SPIP is currently being actively exploited in the wild, necessitating immediate patching.

This is a code injection vulnerability (CWE-94) caused by the incorrect parsing of PHP blocks and the mishandling of specific characters by the var_export function. The vulnerability is accessible to unauthenticated remote attackers.

Because this vulnerability allows for unauthenticated remote code execution, it grants an attacker full control over the affected server. With a CVSS score of 9.8, the business impact includes total system compromise, data theft, and the potential for the server to be used as a pivot point for further network attacks.

Immediate Action: Update all instances of SPIP to version 4.4.20 or the latest available release immediately.

Proactive Monitoring: Inspect server logs for unexpected file modifications, unauthorized PHP execution, or unusual traffic patterns consistent with web shells.

Compensating Controls: If immediate patching is not possible, place the application behind a Web Application Firewall (WAF) with rules designed to block malicious code injection payloads.

Public Exploit Available: Unknown

This vulnerability is of the highest urgency due to confirmed active exploitation. Organizations utilizing SPIP must prioritize upgrading to version 4.4.20 or later across all environments immediately to prevent compromise. Failure to patch will leave systems exposed to widespread, automated exploitation attempts.