148
PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC) (arstechnica.com)
submitted 8 hours ago* (last edited 25 minutes ago) by to c/selfhosted@lemmy.world
31 comments fedilink hide all child comments
 

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 7 hours ago (5 children)

Synology had a critical system and PHP package update yesterday, could it be related 🤔

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 20 points 7 hours ago (4 children)

    No, there is no fix released for this PHP vulnerability

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 7 hours ago (3 children)

    Wouldn't be surprised if the big guys got first dibs before everyone else

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •