Upcoming Critical PHP Security Release

angstrom

@raindog308 said:

@aj_potc said: Interestingly for those in the Red Hat ecosystem, Red Hat doesn't classify these CVEs as Critical, but Important (score = 8.1)

I'm not a security nerd but is this because RedHat's default configuration isn't as vulnerable?

PHP on Ubuntu could be a 9.2 but on RedHat it's an 8.1 - is that a thing?

I suspect that Ubuntu's score of 9.2 is taken directly from PHP security's own score of 9.2:

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

As for Red Hat, they've made their own assessment of the severity

twain

Anyone contacted @labze for the storageboxes?

stable_genius

@aj_potc said:

@raindog308 said:

I'm not a security nerd but is this because RedHat's default configuration isn't as vulnerable?

PHP on Ubuntu could be a 9.2 but on RedHat it's an 8.1 - is that a thing?

Both great questions that I can't answer.

I am assuming Red Hat was given early access to the vulnerability details and had time to come up with their own scores. But I would love to know what, specifically, makes them think their distro is harder to exploit.

Yeah, RHEL is ahead of the curve in security, they seem to take security more seriously than anyone else.

Maybe no one gave Red Hat early access to the vulnerability but they got early access to it anyway, by being proactive

zed

@ScreenReader said:

@Zhenmue said:
How can Cpanel and DA update their php versiones in less than 20-30 minutes

and CloudLinux needs at least 5 hours.

sire, a new exploit has hit the building https://fedi.katze.sh/@elise/117479383739450605

> While not yet fully confirmed, the Fediverse is reporting that the fix
> to at least PHP 8.5.12 may be incomplete:
> https://fedi.katze.sh/@elise/117479383739450605

According to a conversation in #security:ubuntu.com Matrix, Canonical
asked php.org if the issue mentioned in this Mastodon thread was a
real vulnerability or not, and was told that it's "unrelated and not a
real issue". If someone from the PHP security team could reconfirm
this here, that would be greatly appreciated.

https://openwall.com/lists/oss-security/2026/10/21/23

Neoon

How often you wanna update your PHP this week? Yes.

Jord

@Neoon said:
How often you wanna update your PHP this week? Yes.

Because why not

NBO

@jonathann said:
@NameCrane please upgrade the PHP versions. DA reports PHP 8.2.34, which is below 8.2.35

@Francisco

Daniel15

Based on the security advisory, it sounds like it's mostly specific to Apache: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. fpm is exploitable in theory, but nobody has been able to demonstrate it.

Ondřej Sury backported the fix to all PHP versions in his Debian repo, going back to PHP 5.6. If you're stuck on an old version for whatever reason, switch to his repo and update. https://codeberg.org/oerdnj/deb.sury.org/issues/145

@wdmg said:
fyi:

add session.upload_progress.enabled = Off to your php.ini.

it'll fix it.

This isn't a full mitigation as upload progress isn't the only thing that parses multipart requests.

Francisco

@MrRadic said:
FYI - Cloudflare released rules for mitigating this attack.

Also looks like that setting might not be enough, blocking multipart uploads via your WAF might be the temporary solution.

@NBO said:

@jonathann said:
@NameCrane please upgrade the PHP versions. DA reports PHP 8.2.34, which is below 8.2.35

@Francisco

We're on it, ,trust me

Cloudlinux has been slow on updates, but we had applied the php.ini tweaks early this morning as a stopgap.

Francisco

rdes

Another fix that can be compiled as php module:
https://github.com/HOSTED-POWER/php_uploadprogress_guard

(found on DirectAdmin forums, not tested yet).

Ramsterdam

@rdes said:
Another fix that can be compiled as php module:
https://github.com/HOSTED-POWER/php_uploadprogress_guard

(found on DirectAdmin forums, not tested yet).

The author is in LET as well @jgoossens ; thanks for the contribution.

carlos001

Mainfrezzer

the funniest and "spookiest" take away from today is that some repos basically died because people kept refreshing for updates.