The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
It’s just one thing after another. I already had to make sure every computer and VPS has the updated CA certificates earlier today. Now I just finished disabling all of my web servers. I hope Debian doesn’t take forever getting the patch out.
Shouldn’t especially vital services be taken down to secure them?
Yep. Except if taking them down will kill people.
The great hardening continues. Good to see.
Synology had a critical system and PHP package update yesterday, could it be related 🤔
No, there is no fix released for this PHP vulnerability
Wouldn’t be surprised if the big guys got first dibs before everyone else
Dibs on the patches? They are not finite.
