Submitted 10 hours ago by BlackEco@lemmy.blackeco.com to selfhosted@lemmy.world
Disclosure is scheduled at 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched PHP)
Spare a moment’s thought for the dev behind the ondrej PHP mirrors.
“I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced.”
it’s a lot more than wordpress…
so for the docker images of PHP there currently seems to be no patch? or do you think the RC version includes the fix? Because it was released at 07:00UTC i would think it dosnt yet include the fix. dose anyone know how and where to check if the fix was applied? also do we know if docker hubs Vulnerabilities score already include php2shell CVEs?
Shouldn’t especially vital services be taken down to secure them?
Yep. Except if taking them down will kill people.
takes down 112 / 911 services
Don’t worry guys, we’re safe now! ꒰ঌ(˶ˆᗜˆ˵)໒꒱
As if those are running anything as recent as php.
It’s just one thing after another. I already had to make sure every computer and VPS has the updated CA certificates earlier today. Now I just finished disabling all of my web servers. I hope Debian doesn’t take forever getting the patch out.
They took just a few hours to squeeze out a new ca-certificates. On the other hand the last time there was a huge kernel bug it took well over 24 hours…
A bad ca is update a file on every pc and application. A kernal bug is way more involved so it doesn’t make a new problem later.
They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
Think of Louisiana before Katrina. Those systems of pumps and dykes are expensive and had been neglected… which was fine right up until they were severely tested by Katrina.
Our orange city counselman stopped funding repairs and inspections on the dykes and pumps many years ago. They’ve been deteriorating from neglect ever since.
A large hurricane is going to hit at 14:00 UTC
(In 10 minutes)
It’ll almost certainly be handled quietly and nobody will know but system admins, but this could be a bigger thing than usual.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CA | (SSL) Certificate Authority |
| Plex | Brand of media server package |
| VPS | Virtual Private Server (opposed to shared hosting) |
[Thread #142 for this comm, first seen 21st Oct 2026, 12:40] [FAQ] [Full list] [Contact] [Source code]
laughs in keeping an old archive site still in PHP5
The vulnerabilities go back that far. You’re not safe.
Hey, never said I was laughing out of happiness… 😭
The great hardening continues. Good to see.
The beatings cyberattacks will continue until morale security improves
Synology had a critical system and PHP package update yesterday, could it be related 🤔
No, there is no fix released for this PHP vulnerability
Wouldn’t be surprised if the big guys got first dibs before everyone else
BuckFutter@timeyak.com 2 minutes ago
Patches are showing up in the repos now. Ondrej and ubuntu 24.04 have them live now.