Upcoming Critical PHP Security Release
news-web.php.net93 points by xd 6 hours ago
93 points by xd 6 hours ago
If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.
The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
This is gonna rinse so many LAMP WordPress installs where the PHP version is either not getting a patch or the hosting is managed by the user via a contractor or the hosting is managed by a company with a fleet of custom servers etc etc.
We almost need some bot that logs in to every vulnerable PHP server and turns it off to prevent it being properly exploited before the server admin updates it..
Strange to see this so far down the front page. If the rumors are true, it may be worse than Log4Shell.
A lot of people are going to be up late on account of this.
Must be a pretty serious one that can be exploited easily, I haven’t seen this type of pre-announcement of when something will be released before.
Check the Twitter linked video above. It's bad. Just having PHP running on the server is enough.
There is allegedly a temporary mitigation: https://twitter.com/k_firsov/status/2112718728232329240
php.ini:
session.upload_progress.enabled = OffJust a heads up, as of my comment, this is not endorsed by PHP as a migration for the patch.
I wouldn't skip updating, but is there anything else we can do, other than simply shutting down the web server until the fix is available?
No hints as to what versions are affected?
> These vulnerabilities could affect all PHP versions from PHP 5 onwards
https://cert.europa.eu/publications/security-advisories/2026...
> affect PHP versions 5, 6, 7, and 8.
https://www.bleepingcomputer.com/news/security/php-warns-adm... (which references HN as a source - https://news.ycombinator.com/item?id=50167754)