PHP warns it plans to release 2 emergency patches imminently
arstechnica.com
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

  • GreenKnight23@lemmy.worldEnglish
    4·
    1 day ago

    Should I take it down?

    depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don’t take proper backups)?

    • hereiamagain@sh.itjust.worksEnglish
      2·
      8 hours ago

      How dare you (correctly) assume I haven’t taken proper backups!

      Jk lol

      I do have a couple backups I made a few months ago. Never tested restoring them, so I don’t count them as “real”.

      I’m hosting on namecheap servers, using their cpanel and stuff. So I don’t have the option of installing my own PHP version, just selecting theirs.

      But apparently they had some mitigations in place before updating, and then they got us updated.