"I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced."
post
replies:
Shouldn't especially vital services be taken down to secure them?
replies:
It's just one thing after another. I already had to make sure every computer and VPS has the updated CA certificates earlier today. Now I just finished disabling all of my web servers. I hope Debian doesn't take forever getting the patch out.
replies:
Why do it this way? I'm genuinely unaware.
With the plex2shell, they fixed it in a previous update, then told us later.
If PHP knows what the problem is, why announce it now, and then release the patch. Why not release the patch, say hey guys this is an important one, and then tell the world/every script kiddie who didn't know about php2shell AFTER everyone is patched?
Like I get it, I guess, php2shell must already be happening, the vulnerability is already there, but like... Shut up about it? Right? Let more people patch before you announce why the patch exists?
I'm new to this world so maybe this is normal?
replies:
Spare a moment's thought for the dev behind the ondrej PHP mirrors.
replies:
Nextcloud.
Mailcow.
Services are only exposed on local WiFi and behind Tailscale, updated all as soon as possible: still quite safe right?
replies:
Think of Louisiana before Katrina. Those systems of pumps and dykes are expensive and had been neglected... which was fine right up until they were severely tested by Katrina.
Our orange city counselman stopped funding repairs and inspections on the dykes and pumps many years ago (when he destroyed CISA). They've been deteriorating from neglect ever since.
A large hurricane is going to hit at 14:00 UTC
(In 10 minutes)
It'll almost certainly be handled quietly and nobody will know but system admins, but this could be a bigger thing than usual.
Synology had a critical system and PHP package update yesterday, could it be related 🤔
replies:
[removed by mod]
replies:
laughs in keeping an old archive site still in PHP5
replies:
I just happened to read this thread after deciding to open Jerboa after months and I stumbled into this, I have been updating my stuff for the past 30', thank you for making this post and making me aware of this issue! (Even though I'm 8 hours late)
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CA | (SSL) Certificate Authority |
| Plex | Brand of media server package |
| VPS | Virtual Private Server (opposed to shared hosting) |
3 acronyms in this thread; the most compressed thread commented on today has 19 acronyms.
[Thread #142 for this comm, first seen 21st Oct 2026, 12:40] [FAQ] [Full list] [Contact] [Source code]
so for the docker images of PHP there currently seems to be no patch? or do you think the RC version includes the fix? Because it was released at 07:00UTC i would think it dosnt yet include the fix. edit: nvm the patched versions without RC are now also in the docker hub repos.
dose anyone know how and where to check if the fix was applied? also do we know if docker hubs Vulnerabilities score already include php2shell CVEs?
Patches are showing up in the repos now. Ondrej and ubuntu 24.04 have them live now.
20 comments in c/technology@lemmy.world view that post
Hmm, yes i would hope so... So far nothing seems to be affected tho.
https://github.com/syhunt/php2shell-protection
has some background and possible mitigations. But I shut down all my php sites...
Aw beans
Nobody updates PHP lol
It's wild to me that people are still using PHP in 2026. It was known to be a god awful trainwreck of a language all the way back in like 2005 and it certainly hasn't improved much since then. I guess that's what happens when a language peaks right at the height of the dotcom bubble.
replies:
all 52 comments