287
PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC) (arstechnica.com)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
50 comments fedilink hide all child comments
 

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

you are viewing a single comment's thread
view the rest of the comments
[–] 65 points 2 weeks ago (6 children)

"I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced."

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 12 points 2 weeks ago (4 children)

    Seriously though, how quickly do you expect patches to be available for WordPress? I've got one WordPress site that I made years ago for a friend's business. I pop in on it and update stuff every few months.

    Should I take it down?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 20 points 2 weeks ago* (1 child)

    it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.

    edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 weeks ago* (1 child)

    Should I take it down?

    depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don't take proper backups)?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 weeks ago

    How dare you (correctly) assume I haven't taken proper backups!

    Jk lol

    I do have a couple backups I made a few months ago. Never tested restoring them, so I don't count them as "real".

    I'm hosting on namecheap servers, using their cpanel and stuff. So I don't have the option of installing my own PHP version, just selecting theirs.

    But apparently they had some mitigations in place before updating, and then they got us updated.

  • permalink
  • fedilink
  • source
  • parent