A security flaw has been found in specific versions of PHP, the software that runs most dynamic website features like contact forms, user login systems, and online store functionality. The issue impacts PHP 7.3.x versions older than 7.3.13, and PHP 7.4.0, but only when the software is running on Windows servers.
The flaw relates to how PHP handles custom headers for its built-in mail() function, which websites use to send automated emails like contact form responses, password reset links, and order receipts. If these custom headers are written in lowercase, a coding error from a past update can cause the system to incorrectly free the same chunk of memory twice. This type of memory error can potentially be exploited by attackers to run unauthorized code on the server, which may put your website data and your visitors' personal information at risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2019-11049
