Upcoming Critical PHP Security Release

Comments

• angstrom Moderator, Veteran

  5:14PM edited 5:15PM

  @raindog308 said:

  @aj_potc said: Interestingly for those in the Red Hat ecosystem, Red Hat doesn't classify these CVEs as Critical, but Important (score = 8.1)

  I'm not a security nerd but is this because RedHat's default configuration isn't as vulnerable?

  PHP on Ubuntu could be a 9.2 but on RedHat it's an 8.1 - is that a thing?

  I suspect that Ubuntu's score of 9.2 is taken directly from PHP security's own score of 9.2:

  • https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

  As for Red Hat, they've made their own assessment of the severity

  Thanked by 1raindog308
• twain Member

  5:35PM

  Anyone contacted @labze for the storageboxes?
• stable_genius Member

  5:36PM edited 5:39PM

  @aj_potc said:

  @raindog308 said:

  I'm not a security nerd but is this because RedHat's default configuration isn't as vulnerable?

  PHP on Ubuntu could be a 9.2 but on RedHat it's an 8.1 - is that a thing?

  Both great questions that I can't answer.

  I am assuming Red Hat was given early access to the vulnerability details and had time to come up with their own scores. But I would love to know what, specifically, makes them think their distro is harder to exploit.

  Yeah, RHEL is ahead of the curve in security, they seem to take security more seriously than anyone else.

  Maybe no one gave Red Hat early access to the vulnerability but they got early access to it anyway, by being proactive
• zed Veteran

  5:59PM

  @ScreenReader said:

  @Zhenmue said:
  How can Cpanel and DA update their php versiones in less than 20-30 minutes

  and CloudLinux needs at least 5 hours.

  sire, a new exploit has hit the building https://fedi.katze.sh/@elise/117479383739450605

  > While not yet fully confirmed, the Fediverse is reporting that the fix
  > to at least PHP 8.5.12 may be incomplete:
  > https://fedi.katze.sh/@elise/117479383739450605
  
  According to a conversation in #security:ubuntu.com Matrix, Canonical
  asked php.org if the issue mentioned in this Mastodon thread was a
  real vulnerability or not, and was told that it's "unrelated and not a
  real issue". If someone from the PHP security team could reconfirm
  this here, that would be greatly appreciated.
  

  https://openwall.com/lists/oss-security/2026/10/21/23
• Neoon Community Contributor, Veteran

  6:02PM

  How often you wanna update your PHP this week? Yes.
• Jord Moderator, Host Rep, Veteran, Megathread Squad

  7:07PM

  @Neoon said:
  How often you wanna update your PHP this week? Yes.

  Because why not

  Thanked by 1tux
• NBO Member

  8:04PM

  @jonathann said:
  @NameCrane please upgrade the PHP versions. DA reports PHP 8.2.34, which is below 8.2.35

  @Francisco
• Daniel15 Veteran

  8:14PM

  Based on the security advisory, it sounds like it's mostly specific to Apache: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. fpm is exploitable in theory, but nobody has been able to demonstrate it.

  Ondřej Sury backported the fix to all PHP versions in his Debian repo, going back to PHP 5.6. If you're stuck on an old version for whatever reason, switch to his repo and update. https://codeberg.org/oerdnj/deb.sury.org/issues/145

  @wdmg said:
  fyi:

  add session.upload_progress.enabled = Off to your php.ini.

  it'll fix it.

  This isn't a full mitigation as upload progress isn't the only thing that parses multipart requests.
• Francisco Top Host, Host Rep, Veteran

  8:45PM

  @MrRadic said:
  FYI - Cloudflare released rules for mitigating this attack.

  Also looks like that setting might not be enough, blocking multipart uploads via your WAF might be the temporary solution.

  @NBO said:

  @jonathann said:
  @NameCrane please upgrade the PHP versions. DA reports PHP 8.2.34, which is below 8.2.35

  @Francisco

  We're on it, ,trust me

  Cloudlinux has been slow on updates, but we had applied the php.ini tweaks early this morning as a stopgap.

  Francisco

  Thanked by 1behuk
• rdes Member

  9:09PM edited 9:09PM

  Another fix that can be compiled as php module:
  https://github.com/HOSTED-POWER/php_uploadprogress_guard

  (found on DirectAdmin forums, not tested yet).
• Ramsterdam Veteran

  9:13PM

  @rdes said:
  Another fix that can be compiled as php module:
  https://github.com/HOSTED-POWER/php_uploadprogress_guard

  (found on DirectAdmin forums, not tested yet).

  The author is in LET as well @jgoossens ; thanks for the contribution.
• carlos001 Member

  9:23PM edited 9:23PM

  
• Mainfrezzer Member

  9:24PM

  the funniest and "spookiest" take away from today is that some repos basically died because people kept refreshing for updates.

  Thanked by 2MikeA tux