The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

all 4 comments

sorted by: hot top controversial new old
[–] 4 points 33 minutes ago (1 child)

Shouldn't especially vital services be taken down to secure them?

  • source
  • hideshow 1 child comment
  • [–] 1 point 25 minutes ago (1 child)

    Synology had a critical system and PHP package update yesterday, could it be related 🤔

  • source
  • hideshow 1 child comment